I want to first grep some text in log files created within a datetime range and then output the count of occurrence of that text. I have managed to figure out the unix commands to find the files within a date range and grep for that text in these files. However, i am not able to figure out a way to find the count of occurrence of that text

find . -maxdepth 1 -newermt "2021-10-06 02:06:00" ! -newermt "2021-10-06 06:30:00" | xargs grep "text"
Tried using xargs wc -l in the end but it didn't work

CodePudding user response：

You don't need to use xargs in the end if you want to count occurrence, just pipe it to wc -l.

root@HOST:/var/log/apache2# find . -maxdepth 1 -type f -newermt "2021-10-06 02:06:00" ! -newermt "2021-10-06 06:30:00"
./error.log
./error.log.1
root@HOST:/var/log/apache2# find . -maxdepth 1 -type f -newermt "2021-10-06 02:06:00" ! -newermt "2021-10-06 06:30:00" | xargs grep "Apache"
./error.log:[Wed Oct 06 06:25:11.574179 2021] [mpm_prefork:notice] [pid 4138] AH00163: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1j configured -- resuming normal operations
./error.log.1:[Tue Oct 05 06:25:09.859586 2021] [mpm_prefork:notice] [pid 4138] AH00163: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1j configured -- resuming normal operations
root@HOST:/var/log/apache2# find . -maxdepth 1 -type f -newermt "2021-10-06 02:06:00" ! -newermt "2021-10-06 06:30:00" | xargs grep "Apache" | wc -l
2
root@HOST:/var/log/apache2#

There's your count of occurence: 2

Explanation:

• xargs read output of previous commands, then build next command with it
• output of previous command is:

./error.log:[Wed Oct 06 06:25:11.574179 2021] [mpm_prefork:notice] [pid 4138] AH00163: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1j configured -- resuming normal operations
./error.log.1:[Tue Oct 05 06:25:09.859586 2021] [mpm_prefork:notice] [pid 4138] AH00163: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1j configured -- resuming normal operations

• so the result of find . -maxdepth 1 -type f -newermt "2021-10-06 02:06:00" ! -newermt "2021-10-06 06:30:00" | xargs grep "Apache" | xargs wc -l is like calling: wc -l (output of previous command here)
• but that's not what we want (try calling that manually), what we want is wc -l < (output of previous command here), that is: we pass output of previous command to wc's STDIN
• so, instead of using xargs, we should just pipe it