TIDS               time                    Occurance
====================================================
888899889                                  0

##</code><code>##

#!/usr/bin/perl --
use strict;
use warnings;
use Time::Local;
use POSIX qw( strftime );

my %conf = (
    'input'    => "test-logs", #'input.2008-01-01.log',
    'output'   => "test-outfile",#'output.2008-01-01.log',
    'tids'	   => "test-tids",
    'duration' => 3600,
);

my %track;
open ( my $tidsfile,  '<', $conf{ 'tids' } ) or die 'Cannot open tids file '  . $conf{ 'tids' } . ": $!\n";
my @tids = <$tidsfile>;
close $tidsfile;

sub dateconv {
    my ( $date, $time ) = @_;
    my %months = qw( Jan 01 Feb 02 Mar 03 Apr 04 May 05 Jun 06 Jul 07 Aug 08 Sep 09 Oct 10 Nov 11 Dec 12 );

    my @parts = reverse split /:/, $time;
    push @parts, reverse split /-/, $date;

    $parts[4] = $months{ $parts[4] } - 1;

    return timelocal( @parts );
}

open ( my $in,  '<', $conf{ 'input' } ) or die 'Cannot open input file '  . $conf{ 'input' } . ": $!\n";

while ( <$in> ) {
    chomp;
    # Example input:
    # 2008-Jan-01 00:00:00 UTC (GMT +0000) - Toll: channel = seven, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 123456789
    my ( $date, $time, $offset , $channel, $id ) = 
        /(\d{4}-\w{3}-\d{2})\s
        (\d{2}:\d{2}:\d{2})\s
        \w+\s
        \(GMT\s([\+\-]\d{4})\)\s
        -\sToll:\schannel\s=\s(\w+),\s
        ref\s=\s\S+,\s
        tids\s=\s(\d+)
        /x
     or     print "line does not match!\n\t$_\n", next;    
     next unless grep {$id == $_} @tids;    
     my $e_time = dateconv( $date, $time );
     

     if ( defined $track{ $channel }{ $id } ) {
         if ( $e_time - $track{ $channel }{ $id }{ 'time' } > $conf{ 'duration' } ) {
             $track{ $channel }{ $id }{ 'occurrences' }++;
         }
     } else {
         $track{ $channel }{ $id }{ 'time' } = $e_time;
         $track{ $channel }{ $id }{ 'occurrences' } = 1;
     }
 }
close $in;

open ( my $out, '>', $conf{ 'output' } ) or die 'Cannot open output file ' . $conf{ 'input' } . ": $!\n";
print $out <<_HEADER;
TIDS               time                   Occurrence
====================================================
_HEADER

foreach my $channel ( sort keys %track ) {
    foreach my $id ( sort keys %{ $track{$channel} } ) {
        if ( $track{$channel}{$id}{ 'occurrences' } > 1 ) {
            my $date_time = POSIX::strftime( '%Y-%b-%d %H:%M:%S', ( localtime( $track{$channel}{$id}{ 'time' } ) ) );
            print $out "$id\t\t$date_time\t" . $track{$channel}{$id}{ 'occurrences' } . "\n";
        }
    }
}
close $out;
__END__

##</code><code>##

2008-Jan-01 00:00:00 UTC (GMT +0000) - Toll: channel = seven, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 123456789
2008-Jan-01 00:10:00 UTC (GMT +0000) - Toll: channel = six, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 987654321
2008-Jan-01 00:20:00 UTC (GMT +0000) - Toll: channel = three, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 223344221
2008-Jan-01 00:30:00 UTC (GMT +0000) - Toll: channel = four, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 998829992
2008-Jan-01 00:40:00 UTC (GMT +0000) - Toll: channel = three, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 938874724
2008-Jan-01 00:50:00 UTC (GMT +0000) - Toll: channel = two, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 229928828
2008-Jan-01 01:00:00 UTC (GMT +0000) - Toll: channel = five, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 998822992
2008-Jan-01 01:10:00 UTC (GMT +0000) - Toll: channel = seven, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 123456789
2008-Jan-01 01:20:00 UTC (GMT +0000) - Toll: channel = seven, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 123456789
2008-Jan-01 01:30:00 UTC (GMT +0000) - Toll: channel = six, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 987654321
2008-Jan-01 01:40:00 UTC (GMT +0000) - Toll: channel = three, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 223344221
2008-Jan-01 01:50:00 UTC (GMT +0000) - Toll: channel = four, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 998829992
2008-Jan-01 02:00:00 UTC (GMT +0000) - Toll: channel = three, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 938874724
2008-Jan-01 02:10:00 UTC (GMT +0000) - Toll: channel = two, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 229928828
2008-Jan-01 02:20:00 UTC (GMT +0000) - Toll: channel = five, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 998822992
2008-Jan-01 02:30:00 UTC (GMT +0000) - Toll: channel = seven, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 123456789
2008-Jan-01 03:40:00 UTC (GMT +0000) - Toll: channel = seven, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 123456789
2008-Jan-01 02:50:00 UTC (GMT +0000) - Toll: channel = six, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 987654321
2008-Jan-01 03:00:00 UTC (GMT +0000) - Toll: channel = three, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 223344221
2008-Jan-01 03:10:00 UTC (GMT +0000) - Toll: channel = four, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 998829992
2008-Jan-01 03:20:00 UTC (GMT +0000) - Toll: channel = three, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 938874724
2008-Jan-01 03:30:00 UTC (GMT +0000) - Toll: channel = two, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 229928828
2008-Jan-01 03:40:00 UTC (GMT +0000) - Toll: channel = five, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 998822992
2008-Jan-01 03:50:00 UTC (GMT +0000) - Toll: channel = seven, ref = xxx.xxxxxx.xxx.xxxxx.xxxxxxx.xxxxxxxxxxxxxxxxxxxxx, tids = 123456789

##</code><code>##

TIDS               time                    Occurance
====================================================
123456789          2008-Jan-01 01:10:00     2
888899889                                   0

##</code><code>##

123456789
987654321
112233445
888899889