Shell-shell筛选出同一ip在2次访问间隔不超过5分钟的记录

Question

有访问日志如下：
127.0.0.1 2012-09-19 00:01:00
127.0.0.2 2012-09-19 00:02:00
127.0.0.3 2012-09-19 00:03:00
127.0.0.1 2012-09-19 00:04:00
127.0.0.2 2012-09-19 00:10:05
127.0.0.1 2012-09-19 00:11:05
127.0.0.3 2012-09-19 00:12:05
127.0.0.1 2012-09-19 00:13:05
127.0.0.1 2012-09-19 00:14:05
....

筛选出同一ip在2次访问间隔不超过5分钟的记录，得到例如
127.0.0.1 2012-09-19 00:01:00
127.0.0.1 2012-09-19 00:04:00
127.0.0.1 2012-09-19 00:11:05
127.0.0.1 2012-09-19 00:13:05
127.0.0.1 2012-09-19 00:14:05
请教shell如何能实现。

Answer 1

assuming the journal is inside in_file
字符串时间转化为相对于linux元年的秒数，之后判断时间间隔并输出。只要遇到两个时间差满足条件的两条记录都显示，最后 uniq 去重。

awk '{
ts=$2" "$3;
gsub(/[-:]/," ",ts);
ts=mktime(ts);
if(ts-rec[$1,0] <= 300)
print $1" "rec[$1,1]"n"$0;
rec[$1,0]=ts;
rec[$1,1]=$2" "$3;
}' in_file | uniq