Você deve examinar os logs com journalctl e seus parâmetros --since e --until , mas se você se limitar ao top capturado, poderá
sed -n -e '/Wed Nov 15 11:02:07 CET 2017/,/Wed Nov 15 11:03:07 CET 2017/p' <top.log
Wed Nov 15 11:02:07 CET 2017
last pid: 13243; load averages: 1.45, 1.18, 1.04 up 7+19:11:10 11:02:07
82 processes: 1 running, 78 sleeping, 2 stopped, 1 zombie
Mem: 2157M Active, 1244M Inact, 293M Wired, 70M Cache, 62M Buf, 129M Free
Swap: 6144M Total, 2063M Used, 4081M Free, 33% Inuse
PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND
82286 root 118 20 0 831M 247M STOP 0 12:48 0.00% python
1354 root 1 22 0 707M 277M getblk 0 370:38 2.98% reportd
1838 root 1 20 0 673M 145M kqread 0 2:26 0.00% reportqueryd
1839 root 1 20 0 631M 167M kqread 0 3:38 0.00% reportd_helper
1843 root 1 22 0 587M 296M kqread 1 814:52 2.98% hermes
26929 root 8 20 0 501M 300M STOP 0 4:38 0.00% content_scanner
1352 root 1 21 0 490M 182M kqread 1 17:11 0.00% gui
18199 root 9 20 0 470M 127M sbwait 0 1:59 0.00% sophos
14545 root 8 20 0 449M 129M sbwait 0 2:54 0.00% mcafee
1591 root 26 20 0 432M 189M uwait 0 56:34 0.00% splunkd
13185 spamd 1 52 0 423M 388M sbwait 0 0:02 0.00% parl
13186 spamd 1 25 0 423M 387M select 0 0:02 2.98% parl
13184 spamd 1 21 0 423M 387M accept 1 0:02 0.98% parl
13005 root 1 20 0 423M 387M nanslp 0 0:20 0.00% parl
1322 root 1 20 0 371M 78420K kqread 0 2:13 0.00% euq_server
1307 root 1 20 0 369M 71824K kqread 0 1:43 0.00% euq_webui
1082 root 1 20 0 325M 27648K kqread 1 5:18 0.00% interface_controlle
1323 root 1 20 0 325M 81428K kqread 1 26:41 0.00% updaterd
2042 root 1 20 0 311M 17332K kqread 1 3:26 0.00% thirdparty
1003 root 1 20 0 311M 73132K kqread 1 54:30 0.00% commandd
1306 root 1 20 0 307M 5364K kqread 0 0:18 0.00% local_authd
1303 root 1 20 0 305M 7436K kqread 0 0:21 0.00% ftpd.main
1305 root 1 20 0 301M 1528K kqread 1 0:03 0.00% slbl_db_server
1837 root 1 20 0 215M 43284K kqread 1 7:01 0.00% counterd
981 root 1 47 0 196M 17936K kqread 0 10:52 0.00% heimdall
1353 root 1 20 0 190M 15536K kqread 1 8:18 0.00% trackerd
2048 root 1 20 0 190M 11036K kqread 0 0:19 0.00% sntpd
1010 root 1 20 0 188M 6364K kqread 0 0:25 0.00% qlogd
1308 root 1 20 0 188M 5184K kqread 0 0:18 0.00% ipblockd
1304 root 1 20 0 188M 4576K kqread 0 0:13 0.00% gatherer
1669 root 1 20 0 184M 9156K piperd 1 0:01 0.00% external_auth_log
1478 root 1 20 0 184M 4888K kqread 0 0:13 0.00% ginetd
2047 root 1 20 0 165M 8780K kqread 1 0:11 0.00% msgs_db_server
733 root 1 20 0 149M 15484K kqread 1 0:03 0.00% raid_log_watch
Wed Nov 15 11:03:07 CET 2017
last pid: 13464; load averages: 0.94, 1.12, 1.03 up 7+19:12:10 11:03:07
80 processes: 1 running, 76 sleeping, 2 stopped, 1 zombie
Mem: 2213M Active, 1196M Inact, 292M Wired, 59M Cache, 62M Buf, 133M Free
Swap: 6144M Total, 2065M Used, 4079M Free, 33% Inuse
PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND
82286 root 118 20 0 831M 247M STOP 0 12:48 0.00% python
1354 root 1 21 0 707M 277M bo_wwa 1 370:40 1.95% reportd
1838 root 1 20 0 673M 145M kqread 1 2:26 0.00% reportqueryd
1839 root 1 20 0 631M 167M kqread 0 3:38 0.00% reportd_helper
1843 root 1 22 0 603M 299M kqread 1 814:54 2.98% hermes
26929 root 8 20 0 501M 304M STOP 0 4:38 0.00% content_scanner
1352 root 1 21 0 490M 182M kqread 0 17:11 0.00% gui
18199 root 9 20 0 470M 116M sbwait 0 1:59 0.00% sophos
14545 root 8 20 0 449M 118M sbwait 1 2:54 0.00% mcafee
1591 root 26 20 0 432M 189M uwait 0 56:34 0.00% splunkd
13185 spamd 1 20 0 425M 390M accept 1 0:02 0.00% parl
13184 spamd 1 29 0 423M 387M accept 1 0:04 0.00% parl
13186 spamd 1 21 0 423M 387M accept 1 0:04 0.00% parl
13005 root 1 20 0 423M 387M nanslp 1 0:20 0.00% parl
1322 root 1 20 0 371M 78408K kqread 1 2:13 0.00% euq_server
1307 root 1 20 0 369M 71796K kqread 1 1:43 0.00% euq_webui
1082 root 1 20 0 325M 27648K kqread 1 5:18 0.00% interface_controlle
1323 root 1 20 0 325M 80596K kqread 1 26:41 0.00% updaterd
2042 root 1 20 0 311M 17332K kqread 0 3:26 0.00% thirdparty
1003 root 1 20 0 311M 73132K kqread 0 54:30 0.00% commandd
1306 root 1 20 0 307M 5364K kqread 0 0:18 0.00% local_authd
1303 root 1 20 0 305M 7436K kqread 0 0:21 0.00% ftpd.main
1305 root 1 20 0 301M 1528K kqread 1 0:03 0.00% slbl_db_server
1837 root 1 20 0 215M 43284K kqread 1 7:01 0.00% counterd
981 root 1 52 0 196M 18032K kqread 1 10:52 0.00% heimdall
1353 root 1 20 0 190M 15536K kqread 0 8:18 0.00% trackerd
2048 root 1 20 0 190M 11036K kqread 0 0:19 0.00% sntpd
1010 root 1 20 0 188M 6360K kqread 0 0:25 0.00% qlogd
1308 root 1 20 0 188M 5184K kqread 0 0:18 0.00% ipblockd
1304 root 1 20 0 188M 4576K kqread 0 0:13 0.00% gatherer
1669 root 1 20 0 184M 9156K piperd 1 0:01 0.00% external_auth_log
1478 root 1 20 0 184M 4888K kqread 0 0:13 0.00% ginetd
2047 root 1 20 0 165M 8780K kqread 0 0:11 0.00% msgs_db_server
Você deve examinar os logs com journalctl e seus parâmetros --since e --until , mas se você se limitar ao top capturado, poderá
sed -n -e '/Wed Nov 15 11:02:07 CET 2017/,/Wed Nov 15 11:03:07 CET 2017/p' <top.log