awk match between two patterns in an "if/else" statement

Question

I've got an awk issue that I can't seem to figure out. I'm trying to parse out data from SAR and found that some systems are using a different locale and I'm getting different output. The long term solution is to change the locale on all systems for the output data to the same thing, but I have to parse through old data for now and that is not currently an option. Here's the two types of data I get:

24-Hour Output:

21:10:01          all      8.43      0.00      1.81      2.00      0.00     87.76
21:20:01          all      7.99      0.00      1.74      0.82      0.00     89.44
21:30:01          all      8.35      0.00      1.76      0.94      0.00     88.95

12-Hour Output:

09:10:01 PM         all      8.43      0.00      1.81      2.00      0.00     87.76
09:20:01 PM         all      7.99      0.00      1.74      0.82      0.00     89.44
09:30:01 PM         all      8.35      0.00      1.76      0.94      0.00     88.95

I need an awk statement that will get items from 7AM-7PM for all SAR data. I originally had something working, but once I found this issue, it breaks for all the 24-hour output. I trying getting the awk statement to work, but the following doesn't work and I can't figure out how to make it work:

awk '{ if ($2 == "AM" || $2 == "PM" && /07:00/,/07:00/) print $1" "$2; else '/07:00/,/19:00 print $1}' SAR_OUTPUT_FILE.txt

Basically, what I'm trying to output is, if it is in 24-hour format, searchh for 07:00-19:00 and return just the first column of output (since there is no "AM/PM" column. If it founds "AM/PM", I would confider that 12-hour format and want to get everything from 07:00-07:00 and return both the 1st and 2nd column (time + "AM/PM").

Can anyone help me out here?

Your 12-Hour example seems to be in 24 hour format. Is this the way the data actually is? — dawg, Mar 16 '15 at 04:06
@dawg - No, it's getting late after a long day. I updated it to reflect the actual output for the 12-hour. Thanks. — drewrockshard, Mar 16 '15 at 04:08
If the data is exactly as you say then `awk '$2=="PM"&&$1~/0[1-6]:|07:00/;$2=="AM"&&$1~/(0[8-9]|1[1-2]):|07:00/'` should work — , Mar 16 '15 at 08:27

n0741337 · Answer 1 · 2015-03-16T05:58:08.117

Without access to an awk with time functions ( strftime() or mktime() ), you can shift the 12h end times so that they can be tested with the 24h time test.

Here's an awk executable that does that by adjusting the hours in the 12h formatted times to fit 24h time formats. The result is put into variable t for every line and is tested to be in the 24h range.

#!/usr/bin/awk -f

function timeShift(       a, h ) {
    if(NF==9 && split($1, a, ":")==3) {
        if(a[1]==12)        h = $2=="PM"?"12":"00"
        else if($2=="PM")   h = (a[1]+12)%24
        else                h = a[1]
        return( h ":" a[2] ":" a[3] )
    }
    return( $1 )
}

{ t = timeShift() }

t >= "07:00:00" && t <= "19:00:00"

If you need to print fewer fields than the full line, an action block could be added after the final expression.

awk match between two patterns in an "if/else" statement

1 Answers1