Log for Ubuntu 台灣社群
search="title 2"; awk -v x="$search" '$0~x {print $0; getline; print $0}' test.txt改這樣呢？
found=$(search="title 2"; awk -v x="$search" '$0~x {getline nextline; print $0 ", " nextline}' test.txt); echo $found我看不懂你的需求，不過比較時間一般都會轉成 timestamp 對吧？這坨可以取得 Line 1 的前面 datetime 的對應 timestamp
sed '1q;d' time.txt | cut -c 1-19 | while read datetime; do date -d "$datetime" +"%s"; doneas tmp.log
results:
( SORTED_DATA=`cat tmp.log | sort -k4 -k3 -k1 -k2`; KEY=`echo "$SORTED_DATA" | awk '{print $NF}' | uniq`; echo "$KEY" | ( while read k; do ENTRYS=`echo "$SORTED_DATA" | grep $k`; RESULT_IN=`echo "$ENTRYS" | grep IN: | tail -n1`; RESULT_OUT=`echo "$ENTRYS" | grep OUT_ADM: | head -n1`; RESULT=`echo "${RESULT_OUT}\n${RESULT_IN}"`; [ -n "$RESULT_IN" ] && IN_TIME=`date -d "$(echo "$RESULT_IN" | awk '{print $1" "$2}')" +"%s"`; [ -n "$RESULT_OUT" ] && OUT_TIME=`date -d "$(echo "$RESULT_OUT" | awk '{print $1" "$2}')" +"%s"`; [ -n "IN_TIME" ] && [ -n "$OUT_TIME" ] && TIMEDIFF=$(( $IN_TIME - $OUT_TIME )) || TIMEDIFF="n/a"; echo "User: $k's logs: $TIMEDIFF seconds\n$RESULT"; done ) )results:
User: PI2's logs: n/a seconds 2019/05/02 03:07:55 IN: PI2 User: QRA's logs: 3836 seconds 2019/04/30 17:30:37 OUT_ADM: QRA 2019/04/30 18:34:33 IN: QRA User: systemdbuser's logs: 14402 seconds 2019/04/30 18:00:00 OUT_ADM: systemdbuser 2019/04/30 22:00:02 IN: systemdbuser