I was trying to find a string Cannot proceed: the cube has no data in huge test.txt file only between timestamps yesterday 22:30 pm to today 00:30 am.Script:tac test.txt | awk -v today=$(date +%d) -v yesterday=$(date +%d -d yesterday) '/Cannot proceed: the cube has no data/ {f=$0; next} f{if (($3==yesterday && $4>22:30:00) || ($4==today && $4<=00:30:00)) {print; print f} f=}'test.txt:[Thu Jun  8 07:56:17 2014]Local/data///47480280486528/Info(1019022)Writing Database Mapping For [data][Thu Jun  8 12:56:38 2014]Local/data///47480280486528/Info(1250008)Setting Outline Paging Cachesize To [8192KB][Thu Jun  8 22:56:20 2014]Local/data///47480280486528/Info(1013202)Cannot proceed: the cube has no data [Thu Jun  8 23:26:18 2014]Local/data///47480280486528/Info(1013205)Received Command [Load Database][Thu Jun  9 00:16:23 2014]Local/data///47480280486528/Info(1019018)Writing Parameters For Database [Thu Jun  9 00:21:20 2014]Local/data///47480280486528/Info(1013205)Writing Parameters For Database [Thu Jun  9 00:29:00 2014]Local/data///47480280486528/Info(1013205)Cannot proceed: the cube has no data[Thu Jun  9 01:25:21 2014]Local/data///47480280486528/Info(1019018)Cannot proceed: the cube has no data output:[Thu Jun  8 22:56:20 2014]Local/data///47480280486528/Info(1013202)Cannot proceed: the cube has no dataWhy not all strings matching the requiremnts are coming in output ? what I'm missing here ?
Search a string between two timestamps starting from bottom of file
shell script;text processing;awk
I'm not familiar with awk and so can't offer specific advice on its operations, but I'm fairly sure this would work:tac ./file |sed -e /$(date -d2 days ago)/q -e \    '/Cannot proceed: the cube has no data/!d;h;n;G'If you read in a file backwards with tac as you do then your target error should appear first, with the dateline following it. So it holds the last line after encountering target, pulls in the next and appends that last to the end - effectively reordering them. It deletes all other lines.It continues this search until it encounters a 2-day old date at which time it just quits.