Calculate time differences in log file using Powershell based on linux code

Question

EDITED:

Text1.txt:
123.456.789.189:12345
222.222.222.444:56789
451.200.111.321:55555
333.333.333.111:11223

I want to compare ID with IP that weren't registered.

ERROR:

Exception calling "Add" with "2" argument(s): "Item has already been added. Key in dictionary: '123.456.789.189:12345'  Key being added: '123.456.789.189:12345'" +     $nameHash.Add( $data3[4], $data3[3] )

I think this error is due to the existence of duplicates.

How do I solve an issue with duplicates in Hash Table?

My function to calculate time takes in a startdate and an end date.

Function calTimeDiff( $StartDate, $EndDate ) 
{
    "which is = " + (NEW-TIMESPAN –Start $StartDate –End $EndDate).Hours + " hours, " + 
    (NEW-TIMESPAN –Start $StartDate –End $EndDate).Minutes + " minutes, " + 
    (NEW-TIMESPAN –Start $StartDate –End $EndDate).Seconds + " seconds, " + 
    "diff = " + (NEW-TIMESPAN –Start $StartDate –End $EndDate).TotalSeconds + " sec"
}

$lines1 = Get-Content "C:\Temp\Text1.txt" | Select-Object -Unique
$lines2 = Get-Content "C:\Temp\Text2.txt" | Select-Object -Unique

ForEach( $line2 in $lines2 )
{    
    $list = ( $date, $time, $client, $clientIP )
    $list = $line2.Split( "" )
    ForEach( $line1 in $lines1 )
    {
        $disconnectIP = $line1

        If( $disconnectIP -match $list[3] )
        {  
           $date = $list[0]
           $time = $list[1]
           $client = $list[2]
           $clientIP = $list[3] 

           If( $client -eq "serviceClient" )
           {
                $start = $date + " " + $time
           }

           If( $client -eq "Unregistered" )
           {
                $end = $date + " " + $time
           }

           calTimeDiff $start $end 
        }        
    }
}

you mean two clients with the same ip? it depends on your needs (you could determine both differences, only the first or only the last one)... Also - did you tried anything yet? — Martin Brandl
– Martin Brandl, Commented Aug 31, 2015 at 8:21
Could you be more clear about what is in the file and what is not? And what exactly is your problem? Maybe add some sample code.. — DarkLite1
– DarkLite1, Commented Aug 31, 2015 at 8:44
Calculating time differences in Powershell is much simpler if you operate on objects rather than convert everything to text and then operate on text. You haven't described what your inputs look like. Are they objects or are they text? — Walter Mitty
– Walter Mitty, Commented Aug 31, 2015 at 11:57

Hunter Eidson · Accepted Answer · 2015-09-02 12:27:36Z

2

How about something along these lines? I think it's basically behaving the way you were asking for (although you might want to tweak the display-span function a bit...)

#requires -Version 3
function parse-log 
{
    param(
        [string]$line
    )

    $data = $line.split(' ')
    $dateString = '{0} {1}' -f $data[0], $data[1]
    $timeStamp = Get-Date -Date $dateString
    [pscustomobject]@{
        TimeStamp = $timeStamp
        Client    = $data[2]
        IPAddress = $data[3]
    }
}

function display-span
{
    param(
        $logSpan
    )

    '{0} ({1}) ==> {2}' -f $logSpan.IPAddress, $nameHash.Get_Item( $logSpan.IPAddress), $logSpan.Start
    '{0} ({1}) ==> {2}' -f $logSpan.IPAddress, $nameHash.Get_Item( $logSpan.IPAddress), $logSpan.End
    'Start = {0}, End = {1}, diff = {2}' -f $logSpan.Start, $logSpan.End, $logSpan.TimeSpan
    ''
}

$ipStateHash = @{}
$nameHash = @{}
$logArray = @()

$lines1 = Get-Content -Path '.\Text1.txt'
$lines2 = Get-Content -Path '.\Text2.txt'
$lines3 = Get-Content -Path '.\Text3.txt'

# Build Name Hash
foreach( $line3 in $lines3 )
{
    $data3 = $line3.Split( ' ' )
    $nameHash.Add( $data3[4], $data3[3] )
}

foreach( $line2 in $lines2 ) 
{
    $entry = parse-log -line $line2
    switch( $entry.Client ) {
        'serviceClient' 
        {
            if( $lines1 -contains $entry.IPAddress ) 
            { 
                if( $ipStateHash.ContainsKey( $entry.IPAddress ) -eq $false ) 
                {
                    $ipStateHash.Add( $entry.IPAddress, $entry.TimeStamp )
                }
            }
        }
        'Unregistered' 
        {
            if( $ipStateHash.ContainsKey( $entry.IPAddress ) -eq $true ) 
            {
                $start = $ipStateHash.Get_Item( $entry.IPAddress )
                $ipStateHash.Remove( $entry.IPAddress )
                $timespan = $entry.TimeStamp - $start

                $logArray += [pscustomobject]@{
                    IPAddress = $entry.IPAddress
                    Start     = $start
                    End       = $entry.TimeStamp
                    TimeSpan  = $timespan
                }
            }
        }
    }
}

$logArray | ForEach-Object -Process {
    display-span -logSpan $_ 
}

"IPs that weren't Unregistered:"
$ipStateHash.GetEnumerator() | Sort-Object -Property TimeStamp | ForEach-Object -Process {
    '{0} ==> {1}' -f $nameHash.Get_Item( $_.Key ), $_.Value 
}

Using your updated data files from above, the script outputs:

123.456.789.189:12345 (BOB) ==> 7/29/2015 6:00:13 AM
123.456.789.189:12345 (BOB) ==> 7/29/2015 6:00:19 AM
Start = 7/29/2015 6:00:13 AM, End = 7/29/2015 6:00:19 AM, diff = 00:00:06

222.222.222.444:56789 (ALICE) ==> 7/29/2015 6:00:18 AM
222.222.222.444:56789 (ALICE) ==> 7/29/2015 6:00:22 AM
Start = 7/29/2015 6:00:18 AM, End = 7/29/2015 6:00:22 AM, diff = 00:00:04

451.200.111.321:55555 (TOM) ==> 7/29/2015 6:20:03 AM
451.200.111.321:55555 (TOM) ==> 7/29/2015 6:21:19 AM
Start = 7/29/2015 6:20:03 AM, End = 7/29/2015 6:21:19 AM, diff = 00:01:16

IPs that weren't Unregistered:
BOB ==> 7/29/2015 6:01:00 AM

edited Sep 2, 2015 at 12:27

answered Aug 31, 2015 at 14:41

Hunter Eidson

1,91914 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

11 Comments

SumoStash Over a year ago

What if I have more IP in Text1.txt? Does it loop through all of them?

Hunter Eidson Over a year ago

It's built an array of IPs from Text1.txt. The -contains checks to see if the IP we pull from Text2.txt is a member of that array, so there's no reason to loop through Text1.txt... I didn't bother checking with the "Unregistered" clause, since if it's not in the file, it couldn't have made it in the hash table from the "serviceClient" clause.

Hunter Eidson Over a year ago

I just copied/pasted your text1/text2 files that you have up there and it still works for me. I'll update my answer with the new output.

Hunter Eidson Over a year ago

Added some code to dump out the $ipStateHash hash, which contains all of the serviceClients that weren't Unregistered.

SumoStash Over a year ago

So I have another Text3.txt that I want to compare with the $ipStateHash. Instead of displaying the IP, it will display the name. How can I replace the IP with the name? Please see EDITED code.

|

Collectives™ on Stack Overflow

Calculate time differences in log file using Powershell based on linux code

1 Answer 1

11 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

11 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related