Let’s say you’ve got a log file of events with time stamps; the nature of the events isn’t relevant, and let’s say the stamps look like this:
14/Mar/2012:17:49:34 14/Mar/2012:17:49:34 14/Mar/2012:17:49:39 14/Mar/2012:17:49:40 14/Mar/2012:17:49:41 14/Mar/2012:17:49:58 14/Mar/2012:17:51:46 14/Mar/2012:17:51:46 14/Mar/2012:17:52:56 14/Mar/2012:17:52:56 14/Mar/2012:17:52:57 14/Mar/2012:17:52:57 14/Mar/2012:17:53:16 14/Mar/2012:17:53:17 14/Mar/2012:17:53:17
You want to create a graph of the frequency of events in the log file, with time on the x and frequency on the y. An easy tactic here is to put the events into buckets, and then find the count of items in each bucket. If we use a bucket size of one minute, we can simply lop off the seconds field, and then use ‘uniq -c’ to produce our frequency count for each minute:
cat test | cut -d: -f 1-3 | uniq -c 6 14/Mar/2012:17:49 2 14/Mar/2012:17:51 4 14/Mar/2012:17:52 3 14/Mar/2012:17:53
Then with gnuplot:
set xdata time set timefmt "%d/%b/%Y:%H:%M" plot 'events_per_minute.txt' using 2:1 title "events per minute" with impulses
