As far as I can see you don't need that. You already have $count which is the number of connections for a given user, just print if it is larger than 3.

Yes, no issue on that, however the count has to be within the loop, as it performs a lookup over the %users hash. This is the most import piece, as it establishes the relationship.

if (defined $users{$conn1}) # search to check existing of conn to uid.
     {
        if ($num{$uid} > 1)
        {
            print "bad users"; ## user group add command.
        }
     }
[download]

untested as there is no perl on my ipad...

for $uid (keys %users) {
  print "User $uid has ";
  for my $conn (@{$users{$uid}}) {
    my $number = @{$searches{$conn}};
    print "$number searches on connection $conn\n";
    }
  }
}
[download]

Check here: Pull users with multiple search

There also my query is pending. I really need to finish this up.

If you still need help, please provide sufficient sample data.

Log File:

 [04/Jun/2013:13:06:13 -0600] conn=13570 op=14 msgId=13 - BIND dn="uid
+=xyz123,ou=People,o=xyz.com" method=128 version=3
 [04/Jun/2013:15:06:13 -0600] conn=13570 op=14 msgId=15 - RESULT err=0
+ tag=101 nentries=48030 etime=139 SRCH=Q
[download]

Here is the code :

#!/usr/bin/perl
use strict;
use warnings;

my %hash;
my $conn;

open my $fh, '<', 'file1.txt' or die "failed: $!";
while (<$fh>) {
  while ( /conn=(\d+).*uid=(.*?),/g ) {
    $conn = $1;
    $hash{$conn} = $2;
  }
  my ($conn1) = map { $_ =~ /conn=(\d+).*SRCH=Q/ } <$fh>;

  print "$hash{$conn} => $conn\n" if grep /$conn1/, keys %hash;
}
close $fh;
[download]

Hope this helps:

use strict;
use warnings;
use Data::Dumper;

my %users;
my %searches;

#open my $fh, '<', 'file1.txt' or die "failed: $!";
while (<DATA>) { # I use DATA handle instead of $fh for convenience
        if( /BIND/ ) {
                my( $conn, $uid ) = /conn=(\d+).*uid=(.*?),/;
                $users{$uid} = $conn;
        }
        if( /SRCH=Q/ ) {
                my ($timestamp, $conn) = /\[(.*?)\] conn=(\d+)/;
                push @{$searches{$conn}}, $timestamp;
        }
}
#close $fh;

for my $user (keys %users) {
        print "User $user had ".scalar( @{$searches{$users{$user}}} ).
+" searches on connection ".$users{$user}."\n";
}

print Dumper \%users;
print Dumper \%searches;


__DATA__
[04/Jun/2013:13:06:13 -0600] conn=13570 op=14 msgId=13 - BIND dn="uid=
+xyz123,ou=People,o=xyz.com" method=128 version=3
[04/Jun/2013:15:06:13 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:15:06:14 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:15:06:15 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:15:06:16 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:15:06:17 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:17:06:13 -0600] conn=13571 op=14 msgId=13 - BIND dn="uid=
+xyz456,ou=People,o=xyz.com" method=128 version=3
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[download]