use strict; use warnings; my %user; my %conn; while(){ my ($conn) = /conn=(\d+)\s/; my ($uid) = /uid=(.*?),/; $uid ? $user{$conn}=$uid : $conn{$conn}++; } for my $key ( keys %conn ) { print $user{$key}//"Unknown user"; print ": $conn{$key} times in logfile\n"; } __DATA__ [04/Jun/2013:13:06:13 -0600] conn=13570 op=14 msgId=13 - BIND dn="uid=xyz123,ou=People,o=xyz.com" method=128 version=3 [04/Jun/2013:15:06:13 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 tag=101 nentries=48030 etime=139 SRCH=Q [04/Jun/2013:15:06:13 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 tag=101 nentries=48030 etime=139 SRCH=Q [04/Jun/2013:15:06:13 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 tag=101 nentries=48030 etime=139 SRCH=Q