Split large apache log file into the past day

Assuming you have shell access to the server with the log file, try

egrep '2[789]/Sep/2011' logfile.big > /tmp/logfile.small

That will go back to the beginning of the 27th, which is a little over 48 hours, but I would expect that to be much smaller than the whole file, and it's quick to do. Don't forget to gzip the resulting file before you transfer it, that will speed things up even more.


You can make use of the Apache log parser - Analog. It works quickly because written in C. Analog allows specifying the time ranges with the command line options +F and +T which logically stand for 'FROM' and 'TO'.