<div dir="ltr">Manual searching to establish a timeline of events that I can understand when my intel.log chirps.</div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Aug 12, 2016 at 2:40 PM, Azoff, Justin S <span dir="ltr"><<a href="mailto:jazoff@illinois.edu" target="_blank">jazoff@illinois.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><br>
> On Aug 12, 2016, at 2:14 PM, Aashish Sharma <<a href="mailto:asharma@lbl.gov">asharma@lbl.gov</a>> wrote:<br>
><br>
> May be try: <a href="ftp://ftp.ee.lbl.gov/cf-1.2.5.tar.gz" rel="noreferrer" target="_blank">ftp://ftp.ee.lbl.gov/cf-1.2.5.<wbr>tar.gz</a><br>
><br>
> eg: cf conn.log | less<br>
><br>
<br>
</span>Yeah.. cf should be a few times faster than bro-cut for busy log files, especially if the only thing you are doing is converting the timestamp.<br>
It has an optimization that bro-cut doesn't have yet for avoiding converting timestamps if the current one is the same second as the previous one.<br>
<br>
If you are using both tools though and only extracting a few fields, piping bro-cut to cf should be faster than piping cf to bro-cut.<br>
<br>
I'm not sure why converting the timestamp is so important though. What are you doing with the data once you convert the timestamps?<br>
<span class="HOEnZb"><font color="#888888"><br>
<br>
--<br>
- Justin Azoff<br>
<br>
</font></span></blockquote></div><br></div>