Calculate time differences in log file using Powershell based on linux code - powershell

Question

EDITED:
Text1.txt:
123.456.789.189:12345
222.222.222.444:56789
451.200.111.321:55555
333.333.333.111:11223
I want to compare ID with IP that weren't registered.
ERROR:
Exception calling "Add" with "2" argument(s): "Item has already been added. Key in dictionary: '123.456.789.189:12345' Key being added: '123.456.789.189:12345'" + $nameHash.Add( $data3[4], $data3[3] )
I think this error is due to the existence of duplicates.
How do I solve an issue with duplicates in Hash Table?
My function to calculate time takes in a startdate and an end date.
Function calTimeDiff( $StartDate, $EndDate )
{
"which is = " + (NEW-TIMESPAN –Start $StartDate –End $EndDate).Hours + " hours, " +
(NEW-TIMESPAN –Start $StartDate –End $EndDate).Minutes + " minutes, " +
(NEW-TIMESPAN –Start $StartDate –End $EndDate).Seconds + " seconds, " +
"diff = " + (NEW-TIMESPAN –Start $StartDate –End $EndDate).TotalSeconds + " sec"
}
$lines1 = Get-Content "C:\Temp\Text1.txt" | Select-Object -Unique
$lines2 = Get-Content "C:\Temp\Text2.txt" | Select-Object -Unique
ForEach( $line2 in $lines2 )
{
$list = ( $date, $time, $client, $clientIP )
$list = $line2.Split( "" )
ForEach( $line1 in $lines1 )
{
$disconnectIP = $line1
If( $disconnectIP -match $list[3] )
{
$date = $list[0]
$time = $list[1]
$client = $list[2]
$clientIP = $list[3]
If( $client -eq "serviceClient" )
{
$start = $date + " " + $time
}
If( $client -eq "Unregistered" )
{
$end = $date + " " + $time
}
calTimeDiff $start $end
}
}
}

Answer 1

How about something along these lines? I think it's basically behaving the way you were asking for (although you might want to tweak the display-span function a bit...)
#requires -Version 3
function parse-log
{
param(
[string]$line
)
$data = $line.split(' ')
$dateString = '{0} {1}' -f $data[0], $data[1]
$timeStamp = Get-Date -Date $dateString
[pscustomobject]#{
TimeStamp = $timeStamp
Client = $data[2]
IPAddress = $data[3]
}
}
function display-span
{
param(
$logSpan
)
'{0} ({1}) ==> {2}' -f $logSpan.IPAddress, $nameHash.Get_Item( $logSpan.IPAddress), $logSpan.Start
'{0} ({1}) ==> {2}' -f $logSpan.IPAddress, $nameHash.Get_Item( $logSpan.IPAddress), $logSpan.End
'Start = {0}, End = {1}, diff = {2}' -f $logSpan.Start, $logSpan.End, $logSpan.TimeSpan
''
}
$ipStateHash = #{}
$nameHash = #{}
$logArray = #()
$lines1 = Get-Content -Path '.\Text1.txt'
$lines2 = Get-Content -Path '.\Text2.txt'
$lines3 = Get-Content -Path '.\Text3.txt'
# Build Name Hash
foreach( $line3 in $lines3 )
{
$data3 = $line3.Split( ' ' )
$nameHash.Add( $data3[4], $data3[3] )
}
foreach( $line2 in $lines2 )
{
$entry = parse-log -line $line2
switch( $entry.Client ) {
'serviceClient'
{
if( $lines1 -contains $entry.IPAddress )
{
if( $ipStateHash.ContainsKey( $entry.IPAddress ) -eq $false )
{
$ipStateHash.Add( $entry.IPAddress, $entry.TimeStamp )
}
}
}
'Unregistered'
{
if( $ipStateHash.ContainsKey( $entry.IPAddress ) -eq $true )
{
$start = $ipStateHash.Get_Item( $entry.IPAddress )
$ipStateHash.Remove( $entry.IPAddress )
$timespan = $entry.TimeStamp - $start
$logArray += [pscustomobject]#{
IPAddress = $entry.IPAddress
Start = $start
End = $entry.TimeStamp
TimeSpan = $timespan
}
}
}
}
}
$logArray | ForEach-Object -Process {
display-span -logSpan $_
}
"IPs that weren't Unregistered:"
$ipStateHash.GetEnumerator() | Sort-Object -Property TimeStamp | ForEach-Object -Process {
'{0} ==> {1}' -f $nameHash.Get_Item( $_.Key ), $_.Value
}
Using your updated data files from above, the script outputs:
123.456.789.189:12345 (BOB) ==> 7/29/2015 6:00:13 AM
123.456.789.189:12345 (BOB) ==> 7/29/2015 6:00:19 AM
Start = 7/29/2015 6:00:13 AM, End = 7/29/2015 6:00:19 AM, diff = 00:00:06
222.222.222.444:56789 (ALICE) ==> 7/29/2015 6:00:18 AM
222.222.222.444:56789 (ALICE) ==> 7/29/2015 6:00:22 AM
Start = 7/29/2015 6:00:18 AM, End = 7/29/2015 6:00:22 AM, diff = 00:00:04
451.200.111.321:55555 (TOM) ==> 7/29/2015 6:20:03 AM
451.200.111.321:55555 (TOM) ==> 7/29/2015 6:21:19 AM
Start = 7/29/2015 6:20:03 AM, End = 7/29/2015 6:21:19 AM, diff = 00:01:16
IPs that weren't Unregistered:
BOB ==> 7/29/2015 6:01:00 AM