As far as I can see you don't need that. You already have $count which is the number of connections for a given user, just print if it is larger than 3.

There also my query is pending. I really need to finish this up.

If you still need help, please provide sufficient sample data.

Yes, no issue on that, however the count has to be within the loop, as it performs a lookup over the %users hash. This is the most import piece, as it establishes the relationship.

if (defined $users{$conn1}) # search to check existing of conn to uid.
     {
        if ($num{$uid} > 1)
        {
            print "bad users"; ## user group add command.
        }
     }
[download]

untested as there is no perl on my ipad...

for $uid (keys %users) {
  print "User $uid has ";
  for my $conn (@{$users{$uid}}) {
    my $number = @{$searches{$conn}};
    print "$number searches on connection $conn\n";
    }
  }
}
[download]

Check here: Pull users with multiple search

Log File:

 [04/Jun/2013:13:06:13 -0600] conn=13570 op=14 msgId=13 - BIND dn="uid
+=xyz123,ou=People,o=xyz.com" method=128 version=3
 [04/Jun/2013:15:06:13 -0600] conn=13570 op=14 msgId=15 - RESULT err=0
+ tag=101 nentries=48030 etime=139 SRCH=Q
[download]

Here is the code :

#!/usr/bin/perl
use strict;
use warnings;

my %hash;
my $conn;

open my $fh, '<', 'file1.txt' or die "failed: $!";
while (<$fh>) {
  while ( /conn=(\d+).*uid=(.*?),/g ) {
    $conn = $1;
    $hash{$conn} = $2;
  }
  my ($conn1) = map { $_ =~ /conn=(\d+).*SRCH=Q/ } <$fh>;

  print "$hash{$conn} => $conn\n" if grep /$conn1/, keys %hash;
}
close $fh;
[download]

Hope this helps:

use strict;
use warnings;
use Data::Dumper;

my %users;
my %searches;

#open my $fh, '<', 'file1.txt' or die "failed: $!";
while (<DATA>) { # I use DATA handle instead of $fh for convenience
        if( /BIND/ ) {
                my( $conn, $uid ) = /conn=(\d+).*uid=(.*?),/;
                $users{$uid} = $conn;
        }
        if( /SRCH=Q/ ) {
                my ($timestamp, $conn) = /\[(.*?)\] conn=(\d+)/;
                push @{$searches{$conn}}, $timestamp;
        }
}
#close $fh;

for my $user (keys %users) {
        print "User $user had ".scalar( @{$searches{$users{$user}}} ).
+" searches on connection ".$users{$user}."\n";
}

print Dumper \%users;
print Dumper \%searches;


__DATA__
[04/Jun/2013:13:06:13 -0600] conn=13570 op=14 msgId=13 - BIND dn="uid=
+xyz123,ou=People,o=xyz.com" method=128 version=3
[04/Jun/2013:15:06:13 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:15:06:14 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:15:06:15 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:15:06:16 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:15:06:17 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:17:06:13 -0600] conn=13571 op=14 msgId=13 - BIND dn="uid=
+xyz456,ou=People,o=xyz.com" method=128 version=3
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[download]