#!/usr/bin/perl use strict; use warnings; use 5.010; my $no = 0; my %monthNos = map {$_ => ++$no} qw{ Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec }; while (my $line = ) { chomp($line); my ($mon, $day, $time, $loghost, $prog, $remainder) = split m{:?\s+}, $line, 6; my ($user) = $remainder =~ m{user=([^,]+)}; my ($rip) = $remainder =~ m{rip=([^,]+)}; my ($op) = $remainder =~ m{\s(==|<=|\*\*|\+\+)\s}; my $yr = 2012; $remainder =~ tr/"/'/; $_ //= '' for $user, $rip; given ($op) { when ('==') {print "Do da ==\n";} when ('<=') {print "Doing <=\n";} when ('**') {print "Process **\n";} when (undef) {print "No op found\n";} default {print "Duh! Can't do $op\n";} } my $csv = sprintf q{%02d/%02d/%s %s,%s,%s,"%s",%s,%s}, $day, $monthNos{$mon}, $yr, $time, $loghost, $prog, $remainder, $user, $rip; print "$csv\n"; } __DATA__ May 2 07:06:20 l.net exim[1234]: 2012-05-02 07:06:20 1e <= inb@it.com May 2 07:06:20 l.net exim[1234]: 2012-05-02 07:06:20 1e <= inb@it.com May 2 07:06:20 l.net exim[1235]: 2012-05-02 07:06:20 1e => pp May 2 07:06:20 l.net exim[1235]: 2012-05-02 07:06:20 1e ++ pp #### Doing <= 02/05/2012 07:06:20,l.net,exim[1234],"2012-05-02 07:06:20 1e <= inb@it.com ",, Doing <= 02/05/2012 07:06:20,l.net,exim[1234],"2012-05-02 07:06:20 1e <= inb@it.com ",, No op found 02/05/2012 07:06:20,l.net,exim[1235],"2012-05-02 07:06:20 1e => pp ",, Duh! Can't do ++ 02/05/2012 07:06:20,l.net,exim[1235],"2012-05-02 07:06:20 1e ++ pp ",,