my (%user_choice, %audit_rec); # Update: Parens added to fix syntax

# Get User input into $user_choice{user}, $user_choice{module} .. and $user_choice{host}

#after reading the record, get it into %audit_rec like this:
 @audit_rec{ qw| time host user module msg  | } = # This is a "Hash-slice"
          split(']\[|]\s+|^\[',$audit_data);

 # Now, you can compare $user_choice{xxx} with $audit_rec{xxx} , and loop through values for xxx.

# A more advanced technique would be to create a "dispatch table" hash 
# Search for that on this site, if interested.