Input file    Mar 19 06:10:16 ip-172-2-0-53 sendmail[28131]: v2JDA1k4028131: to=root, ctladdr=root (0/0), delay=00:00:15, xdelay=00:00:00, mailer=relay, pri=30580, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (v2JDAG5W028134 Message accepted for delivery)Mar 19 14:41:26 ip-172-2-0-53 sendmail[29483]: v2JLfNFN029481: to=<xyz@ifaded.com>,<abc@ifaded.com>, delay=00:00:03, xdelay=00:00:03, mailer=esmtp, pri=151738, relay=ifaded-com.mail.p...ction.outlook.com. [xx.xxx.x.x], dsn=2.0.0, stat=Sent (<ssssa@heg.jkadionbub.com> [InternalId=31288836753166, Hostname=ERGsDGddssdD5.namprd07.prod.outlook.com] 8924 bytes in 0.309, 28.142 KB/sec Queued mail for delivery)Mar 19 06:10:26 ip-172-2-0-53 sendmail[28131]: v2JDA1k4028131: to=root, ctladdr=root (0/0), delay=00:20:15, xdelay=00:00:00, mailer=relay, pri=30580, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (v2JDAG5W028134 Message accepted for delivery)I have tried following command cat logh.txt | grep -E -o  delay=.[^,]*|^[^ip]+ i want to find out top 5 delay time  with date how can i solve this problem with llinux command.i am getting following output Mar 19 06:10:16 delay=00:00:15Mar 19 14:41:26 delay=00:00:03Mar 19 06:10:26 delay=00:20:15Desired output  Mar 19 06:10:26 delay=00:20:15  Mar 19 06:10:16 delay=00:00:15  Mar 19 14:41:26 delay=00:00:03
top five delay time with log file with shell script
text processing;sort
You're going to need multiple passes. Here's a solution that uses sed, sort, head and cut to give you the top 5 in the order you want.sed -e 's/^\([A-Za-z]\{3\} \{1,2\}[0-9]\{1,2\} \{1,2\}\([0-9]\{2\}:\)\{2\}[0-9]\{2\}\).* \(delay=\([0-9]\{2\}\):\([0-9]\{2\}\):\([0-9]\{2\}\)\).*/\4\5\6 \1 \3/' | sort -nr | head -n5 | cut -d\  -f2-With your provided input, this emits:Mar 19 06:10:26 delay=00:20:15Mar 19 06:10:16 delay=00:00:15Mar 19 14:41:26 delay=00:00:03(Assumes its input is in the log format you provided, and that it's only fed lines with the data you want. An additional grep at the beginning may be necessary.)What it's doingLet's break it down.sedsed stands for Stream EDitor. It's routinely used for applying regular expressions to text streams.sed's regular expression's/^\([A-Za-z]\{3\} \{1,2\}[0-9]\{1,2\} \{1,2\}\([0-9]\{2\}:\)\{2\}[0-9]\{2\}\).* \(delay=\([0-9]\{2\}\):\([0-9]\{2\}\):\([0-9]\{2\}\)\).*/\4\5\6 \1 \3/'That's quite the mouthful, but it rather needs to be, in order to avoid catastrophic backtracking.We're using Regex substitutions. To see what it's doing in detail, try Regex101. For now, know that it takes the input:Mar 19 06:10:16 ip-172-2-0-53 sendmail[28131]: v2JDA1k4028131: to=root, ctladdr=root (0/0), delay=00:00:15, xdelay=00:00:00, mailer=relay, pri=30580, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (v2JDAG5W028134 Message accepted for delivery)Mar 19 14:41:26 ip-172-2-0-53 sendmail[29483]: v2JLfNFN029481: to=<jdoe@ifaded.com>,<ksmith@ifaded.com>, delay=00:00:03, xdelay=00:00:03, mailer=esmtp, pri=151738, relay=ifaded-com.mail.p...ction.outlook.com. [xx.xxx.x.x], dsn=2.0.0, stat=Sent (<4253fa32d79a11ce3b5f5147278dfae9@heg.jkadionbub.com> [InternalId=31288836753166, Hostname=FOOBAR1.namprd07.prod.outlook.com] 8924 bytes in 0.309, 28.142 KB/sec Queued mail for delivery)Mar 19 06:10:26 ip-172-2-0-53 sendmail[28131]: v2JDA1k4028131: to=root, ctladdr=root (0/0), delay=00:20:15, xdelay=00:00:00, mailer=relay, pri=30580, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (v2JDAG5W028134 Message accepted for delivery)and converts it to000015 Mar 19 06:10:16 delay=00:00:15000003 Mar 19 14:41:26 delay=00:00:03002015 Mar 19 06:10:26 delay=00:20:15sed regex match^\([A-Za-z]\{3\} \{1,2\}[0-9]\{1,2\} \{1,2\}\([0-9]\{2\}:\)\{2\}[0-9]\{2\}\).* \(delay=\([0-9]\{2\}\):\([0-9]\{2\}\):\([0-9]\{2\}\)\).*We first explicitly match the date components; we'll need those for output, later. We then find and match the delay and its timing components individually; the delay, you wanted in your output. The timing components, we'll need later, for sorting.sed's regex substitution\4\5\6 \1 \3In the substitution side of the regex, we take the timing components we grabbed, and we concatenate them without the : delimeter they originally had. This is important, as we're going to use these for sort later. After the timing components, we append the date string and the whole, original delay string; we'll want them after we sort.sortsort -nrSince our input now begins with a decimal number instead of a stringy time stamp, we can use sort's numeric mode, specified with the -n flag.By default, sort sorts in ascending order, which places the largest values at the end. Since this would mean processing all of sort's output to find the largest N values, we use sort's -r flag to reverse the output order; now, the largest values will be output first, and we can head instead of `tail.Our output, at this point, looks like this:002015 Mar 19 06:10:26 delay=00:20:15000015 Mar 19 06:10:16 delay=00:00:15000003 Mar 19 14:41:26 delay=00:00:03headhead -n5At this point, our input will have the largest values first, and we already know we want the largest 5 values. So we use head's -n parameter to tell head how many values we want.Since, in this example, we don't actually have more than 5 values, we still get all of the output we were fed in.002015 Mar 19 06:10:26 delay=00:20:15000015 Mar 19 06:10:16 delay=00:00:15000003 Mar 19 14:41:26 delay=00:00:03cutcut -d\  -f2-Since we don't need it any more, we need to strip out the numeric sorting key we inserted with sed back in the first step. For this, we turn to cut, which allows us to choose which fields we want from each row provided.We use cut's -d parameter to tell it what our field separator, our delimiter, is. Because the field separator is whitespace, we need to escape it with \, giving us -d\.From cut's perspective, this breaks the row 002015 Mar 19 06:10:26 delay=00:20:15into 002015 Mar 19 06:10:26 delay=00:20:15.To specify which fields we want, we use -f. Since we want all but the first field, we use -f2-, giving us our desired output:Mar 19 06:10:26 delay=00:20:15Mar 19 06:10:16 delay=00:00:15Mar 19 14:41:26 delay=00:00:03