I have a file with multiple data structures in it like so:
eventTimestamp: 2010-03-23T07:56:19.166
result: Allowed
protocol: SMS
payload: RCOMM_SMS
eventTim
A bit of a kludge, but this script assumes you have the unix "date" command. Also hard coded your start and end timestamps in the BEGIN block. Note that your test data listed above does not fall within your sample start/end times.
#!/usr/bin/awk -f
BEGIN {
command="date -f\"%s\" -d \"2010-03-23 12:56:47\""; command | getline startTime; close(command)
command="date -f\"%s\" -d \"2010-03-23 13:56:47\""; command | getline endTime; close(command)
}
$0 ~ /^eventTimestamp:/ {
command="date -f\"%s\" -d " $2; command | getline currTime; close(command)
if (currTime >= startTime && currTime <= endTime) {
printIt="true"
}else{
printIt="false";
}
}
printIt == "true" { print }