timefind v1.0.2.2 has been released (available at https://ant.isi.edu/software/timefind/).
Scientists at Los Alamos National Laboratory and at USC/ISI have developed two tools to handle indexing and selection of multiple network data types: indexer and timefind.
Most of us have processed large amounts of timestamped data. Given .pcap spanning 2010-2015, we might want to downselect on a time range, e.g., 2015-Jan-01 to 2015-Feb-01. An existing way to downselect would be to build fragile regexes and walk the directory tree for each search: inefficient and inevitably re-written.
indexer will walk through all your data and index the timestamps of the earliest and latest records.
timefind will then use the indexes and retrieve the filenames that overlap with the given time range input. To downselect 2015-Jan-01 to 2015-Feb-01 on “dns” data, use:
timefind --begin="2015-01-01" --end="2015-02-01" dns
It’s that simple and consistent.