[[04/Jun/2013:13:06:13 -0600] conn=13570 op=14 msgId=13 - BIND dn="uid=xyz123,ou=People,o=xyz.com" method=128 version=3
[04/Jun/2013:15:06:13 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:13:06:13 -0600] conn=13572 op=14 msgId=13 - BIND dn="uid=xyz123,ou=People,o=xyz.com" method=128 version=3
[04/Jun/2013:15:06:13 -0600] conn=13572 op=14 msgId=15 - RESULT err=0 tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:17:06:13 -0600] conn=13571 op=14 msgId=13 - BIND dn="uid=someoneelse,ou=People,o=xyz.com" method=128 version=3
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:13:06:13 -0600] conn=13573 op=14 msgId=13 - BIND dn="uid=xyz123,ou=People,o=xyz.com" method=128 version=3
[04/Jun/2013:15:06:13 -0600] conn=13573 op=14 msgId=15 - RESULT err=0 tag=101 nentries=48030 etime=139


##</code><code>##


User xyz123 had 1 searches on connection 13570
User xyz123 had 1 searches on connection 13572
Can't use an undefined value as an ARRAY reference at hash1.pl line 23, <IN> line 8.


##</code><code>##


use strict;
use warnings;
use Data::Dumper;

my %users;
my %searches;


while (<DATA>) { # I use DATA handle instead of $fh for convenience
		if( /BIND/ ) {
				my( $conn, $uid ) = /conn=(\d+).*uid=(.*?),/;
				push @{$users{$uid}}, $conn;
		}
		if( /SRCH=Q/ ) {
				my ($timestamp, $conn) = /\[(.*?)\] conn=(\d+)/;
				push @{$searches{$conn}}, $timestamp;
		}
}


for my $user (keys %users) {
		for my $conn (@{$users{$user}}) {
				print "User $user had ".scalar( @{$searches{$conn}} )." searches on connection $conn\n";
				print "\t=> Bad user!\n" if  @{$searches{$conn}} > 3;
		}
}

print Dumper \%users;
print Dumper \%searches;