dreness/logfreq.sh

## logfreq.sh
#!/bin/zsh
# set -x

# Reference: https://dreness.com/blog/archives/155773

usage() {
    print "$1: Use histograms to explore os_log data.

Usage: $1 [-k logKey] [-l logtime] [-h] [predicate]
  -k  Calculate frequency of unique values of this log attribute.
      Default: processImagePath
  -l  Only query logs written in the last 'logtime' time period.
      This value is passed directly to log's '--last' option.
      Default: 2m (two minutes).
  -h  show this help

  The 'predicate' positional argument (if present) is passed directly to 'log'
  as the value for the '--predicate' option. This should be a quoted string.

  Examples:
  # Look Who's Talking? (over the last 24 hours)
  % $1 -l 1d

  # Look Who's Talking Now? (the default time scope is two minutes)
  % $1

  # Format Perspective - display the recent unique kinds of log messages from
  # Finder
  % $1 -k formatString 'process = \"Finder\"'
  "
  exit 1
}

SCRIPT=$(basename $0)
LOG="/usr/bin/log"  # did you know that 'log' is a zsh builtin?
KEY='processImagePath'
LAST='2m'
LOGQ=''

while getopts 'k: l: h' arg; do
  case $arg in
    k) KEY=$OPTARG;;
    l) LAST=$OPTARG;;
    h) usage ${SCRIPT}; exit 0;;
  esac
done
shift $((OPTIND -1))

#printf "1: %s, 2: %s\n" $1 $2
#print "key: $KEY"
#print "LAST: $LAST"
#print "dollar at: $@"

# Any remaining arguments are used as a log query predicate
if [[ ! -z $1 ]]
then
    LOGQ=(--predicate $1)
fi

${LOG} show --info --last "${LAST}" --style ndjson ${LOGQ} | jq ".${KEY}" | sort | uniq -c | sort -n


#log show --last 1m --style json $@ | jq ${F} | awk "/${KEY}/ {print \$2}" | sort | uniq -c | sort -n
#F=$(printf '.[] | select(.%s != "") | {%s}' ${KEY} ${KEY})
#F=$(printf ".%s" ${KEY})
#${LOG} show --last "${LAST}" --style ndjson "$@" | jq ${F} | awk "/${KEY}/ {print \$2}" | sort | uniq -c | sort -n
#${LOG} show --last "${LAST}" --style ndjson "$@" | jq "${F}" | awk "/${KEY}/ {print \$2}"
	#!/bin/zsh
	# set -x

	# Reference: https://dreness.com/blog/archives/155773

	usage() {
	print "$1: Use histograms to explore os_log data.

	Usage: $1 [-k logKey] [-l logtime] [-h] [predicate]
	-k Calculate frequency of unique values of this log attribute.
	Default: processImagePath
	-l Only query logs written in the last 'logtime' time period.
	This value is passed directly to log's '--last' option.
	Default: 2m (two minutes).
	-h show this help

	The 'predicate' positional argument (if present) is passed directly to 'log'
	as the value for the '--predicate' option. This should be a quoted string.

	Examples:
	# Look Who's Talking? (over the last 24 hours)
	% $1 -l 1d

	# Look Who's Talking Now? (the default time scope is two minutes)
	% $1

	# Format Perspective - display the recent unique kinds of log messages from
	# Finder
	% $1 -k formatString 'process = \"Finder\"'
	"
	exit 1
	}

	SCRIPT=$(basename $0)
	LOG="/usr/bin/log" # did you know that 'log' is a zsh builtin?
	KEY='processImagePath'
	LAST='2m'
	LOGQ=''

	while getopts 'k: l: h' arg; do
	case $arg in
	k) KEY=$OPTARG;;
	l) LAST=$OPTARG;;
	h) usage ${SCRIPT}; exit 0;;
	esac
	done
	shift $((OPTIND -1))

	#printf "1: %s, 2: %s\n" $1 $2
	#print "key: $KEY"
	#print "LAST: $LAST"
	#print "dollar at: $@"

	# Any remaining arguments are used as a log query predicate
	if [[ ! -z $1 ]]
	then
	LOGQ=(--predicate $1)
	fi

	${LOG} show --info --last "${LAST}" --style ndjson ${LOGQ} \| jq ".${KEY}" \| sort \| uniq -c \| sort -n



	#log show --last 1m --style json $@ \| jq ${F} \| awk "/${KEY}/ {print \$2}" \| sort \| uniq -c \| sort -n
	#F=$(printf '.[] \| select(.%s != "") \| {%s}' ${KEY} ${KEY})
	#F=$(printf ".%s" ${KEY})
	#${LOG} show --last "${LAST}" --style ndjson "$@" \| jq ${F} \| awk "/${KEY}/ {print \$2}" \| sort \| uniq -c \| sort -n
	#${LOG} show --last "${LAST}" --style ndjson "$@" \| jq "${F}" \| awk "/${KEY}/ {print \$2}"