使用基于linux代码的Powershell计算日志文件中的时间差 [英] Calculate time differences in log file using Powershell based on linux code

问题描述

EDITED：

Text1.txt:
123.456.789.189:12345
222.222.222.444:56789
451.200.111.321:55555
333.333.333.111:11223

我想将ID与未注册的IP进行比较。

I want to compare ID with IP that weren't registered.

错误：

Exception calling "Add" with "2" argument(s): "Item has already been added. Key in dictionary: '123.456.789.189:12345'  Key being added: '123.456.789.189:12345'" +     $nameHash.Add( $data3[4], $data3[3] )

我认为这个错误是由于存在重复。

I think this error is due to the existence of duplicates.

如何解决哈希表中重复的问题？

How do I solve an issue with duplicates in Hash Table?

我的计算时间的功能需要一个开始日期和结束日期。

My function to calculate time takes in a startdate and an end date.

Function calTimeDiff( $StartDate, $EndDate ) 
{
    "which is = " + (NEW-TIMESPAN –Start $StartDate –End $EndDate).Hours + " hours, " + 
    (NEW-TIMESPAN –Start $StartDate –End $EndDate).Minutes + " minutes, " + 
    (NEW-TIMESPAN –Start $StartDate –End $EndDate).Seconds + " seconds, " + 
    "diff = " + (NEW-TIMESPAN –Start $StartDate –End $EndDate).TotalSeconds + " sec"
}

$lines1 = Get-Content "C:\Temp\Text1.txt" | Select-Object -Unique
$lines2 = Get-Content "C:\Temp\Text2.txt" | Select-Object -Unique

ForEach( $line2 in $lines2 )
{    
    $list = ( $date, $time, $client, $clientIP )
    $list = $line2.Split( "" )
    ForEach( $line1 in $lines1 )
    {
        $disconnectIP = $line1

        If( $disconnectIP -match $list[3] )
        {  
           $date = $list[0]
           $time = $list[1]
           $client = $list[2]
           $clientIP = $list[3] 

           If( $client -eq "serviceClient" )
           {
                $start = $date + " " + $time
           }

           If( $client -eq "Unregistered" )
           {
                $end = $date + " " + $time
           }

           calTimeDiff $start $end 
        }        
    }
}    

推荐答案

这些东西怎么样？我认为它基本上是你要求的方式（虽然你可能想要调整显示跨度功能有点...）

How about something along these lines? I think it's basically behaving the way you were asking for (although you might want to tweak the display-span function a bit...)

#requires -Version 3
function parse-log 
{
    param(
        [string]$line
    )

    $data = $line.split(' ')
    $dateString = '{0} {1}' -f $data[0], $data[1]
    $timeStamp = Get-Date -Date $dateString
    [pscustomobject]@{
        TimeStamp = $timeStamp
        Client    = $data[2]
        IPAddress = $data[3]
    }
}

function display-span
{
    param(
        $logSpan
    )

    '{0} ({1}) ==> {2}' -f $logSpan.IPAddress, $nameHash.Get_Item( $logSpan.IPAddress), $logSpan.Start
    '{0} ({1}) ==> {2}' -f $logSpan.IPAddress, $nameHash.Get_Item( $logSpan.IPAddress), $logSpan.End
    'Start = {0}, End = {1}, diff = {2}' -f $logSpan.Start, $logSpan.End, $logSpan.TimeSpan
    ''
}

$ipStateHash = @{}
$nameHash = @{}
$logArray = @()

$lines1 = Get-Content -Path '.\Text1.txt'
$lines2 = Get-Content -Path '.\Text2.txt'
$lines3 = Get-Content -Path '.\Text3.txt'

# Build Name Hash
foreach( $line3 in $lines3 )
{
    $data3 = $line3.Split( ' ' )
    $nameHash.Add( $data3[4], $data3[3] )
}

foreach( $line2 in $lines2 ) 
{
    $entry = parse-log -line $line2
    switch( $entry.Client ) {
        'serviceClient' 
        {
            if( $lines1 -contains $entry.IPAddress ) 
            { 
                if( $ipStateHash.ContainsKey( $entry.IPAddress ) -eq $false ) 
                {
                    $ipStateHash.Add( $entry.IPAddress, $entry.TimeStamp )
                }
            }
        }
        'Unregistered' 
        {
            if( $ipStateHash.ContainsKey( $entry.IPAddress ) -eq $true ) 
            {
                $start = $ipStateHash.Get_Item( $entry.IPAddress )
                $ipStateHash.Remove( $entry.IPAddress )
                $timespan = $entry.TimeStamp - $start

                $logArray += [pscustomobject]@{
                    IPAddress = $entry.IPAddress
                    Start     = $start
                    End       = $entry.TimeStamp
                    TimeSpan  = $timespan
                }
            }
        }
    }
}

$logArray | ForEach-Object -Process {
    display-span -logSpan $_ 
}

"IPs that weren't Unregistered:"
$ipStateHash.GetEnumerator() | Sort-Object -Property TimeStamp | ForEach-Object -Process {
    '{0} ==> {1}' -f $nameHash.Get_Item( $_.Key ), $_.Value 
}

使用上面更新的数据文件，脚本输出：

Using your updated data files from above, the script outputs:

123.456.789.189:12345 (BOB) ==> 7/29/2015 6:00:13 AM
123.456.789.189:12345 (BOB) ==> 7/29/2015 6:00:19 AM
Start = 7/29/2015 6:00:13 AM, End = 7/29/2015 6:00:19 AM, diff = 00:00:06

222.222.222.444:56789 (ALICE) ==> 7/29/2015 6:00:18 AM
222.222.222.444:56789 (ALICE) ==> 7/29/2015 6:00:22 AM
Start = 7/29/2015 6:00:18 AM, End = 7/29/2015 6:00:22 AM, diff = 00:00:04

451.200.111.321:55555 (TOM) ==> 7/29/2015 6:20:03 AM
451.200.111.321:55555 (TOM) ==> 7/29/2015 6:21:19 AM
Start = 7/29/2015 6:20:03 AM, End = 7/29/2015 6:21:19 AM, diff = 00:01:16

IPs that weren't Unregistered:
BOB ==> 7/29/2015 6:01:00 AM

这篇关于使用基于linux代码的Powershell计算日志文件中的时间差的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！