Can anyone explain why this pattern matching is not working using sed

Question

Trying to print out specific times of logs based on recommendation from this thread from super user. I am not sure why my patterns are not being matched by sed. I have the sample date and time I am using pasted here. If I use

sed -n '/2014-03-27 07:00:00/ , /2014-03-27 11:25:00/p' log-file-name

I am expecting it to print all lines that matches between 7 am to 11 am . But I get zero matches. If I remove "-n", it prints the entire lines from 3 am to 16:14 as result. I tried tweaking the sed command above with single and double quotes and tried different spacing options. But the results are always "all or none" . Can somebody please explain why sed is not printing the lines for the hour window I am asking it to print?

Answer 1

You're trying to use sed with the start, stop pattern feature.

So if a line matching your first (start) pattern is found, output will be returned until a line matching the second (stop) pattern is found.

If the start line isn't exactly present in your file you will get no results.

Removing the -n flag from your options means that all will be printed, even if they don't match your pattern. Using sed with -n '/.../p' will make it behave like grep.

I found a useful tutorial here

For your case, you might consider a pattern something like:

\d{4}-\d{2}-\d{2} ((0[7-9])|(1[0-1])):\d{2}:\d{2},\d{3}

The above would match all times from 07:00 to 11:59
some explanations:
\d{4} = match 4 digits (year, eg. 2014)
(0[7-9]) = match 07 - 09
| = OR
(1[0-1]) = match 10 -11

Answer 2

Unix is awesome at doing small things, don't make them too long. This takes the awk from the linked post and adds a date pipe.

This finds all dates at the start of the line with 2014-03-27, takes that output and finds all times with hours (second field) grater or equal to 7 and less than 11.

grep ^2014-03-27 log-file | awk -F'[: ]' '$2 >= 7 && $2 < 11 { print }'

Answer 3

It will be complicated using regex. Perhaps something like this will do:

awk '$1 FS $2>=s{p=1} $1 FS $2>e{exit}p' s="2014-03-27 07:00:00" e="2014-03-27 11:25:00" file

Explanation:

awk '
  $1 FS $2>=s{     # `$1 FS $2` is the string the consists of field 1, a space, 
                   # and field 2. If it is larger or equal (string comparison) 
                   # to the variable s, then: 
    p=1            # set a variable p to 1
  }
  $1 FS $2>e{      # if the string $1 FS $2 is larger than variable e, then
    exit           # exit the script ( stop processing the file )
  }
  p                # if variable p is equal to 1 then print the record (line)
' s="2014-03-27 07:00:00" e="2014-03-27 11:25:00" file    
                   # line above: set variables p and s and specify file name

$1 FS $2 is the string the consists of field 1, a space, and field 2. If it is larger or equal (string comparison) to the variable s then set a variable p to 1