If you still need help, please provide sufficient sample data.

Yes, no issue on that, however the count has to be within the loop, as it performs a lookup over the %users hash. This is the most import piece, as it establishes the relationship.

if (defined $users{$conn1}) # search to check existing of conn to uid.
     {
        if ($num{$uid} > 1)
        {
            print "bad users"; ## user group add command.
        }
     }
[download]

untested as there is no perl on my ipad...

for $uid (keys %users) {
  print "User $uid has ";
  for my $conn (@{$users{$uid}}) {
    my $number = @{$searches{$conn}};
    print "$number searches on connection $conn\n";
    }
  }
}
[download]

hdb,

No perl on your ipad? Tragic.

My first generation iPad can't be updated past 5.0.1, so I've jailbroken it and put on perl, vim and other utilities. With a jailbroken iPad, you can link app directories, like Textastic and GoodReader, to your home Documents directory. Also, I use git to keep my projects synchronized for when I'm working away from an Internet connection.

Visit this site if you want to get perl for your iPad.

Anne

Check here: Pull users with multiple search

Log File:

 [04/Jun/2013:13:06:13 -0600] conn=13570 op=14 msgId=13 - BIND dn="uid
+=xyz123,ou=People,o=xyz.com" method=128 version=3
 [04/Jun/2013:15:06:13 -0600] conn=13570 op=14 msgId=15 - RESULT err=0
+ tag=101 nentries=48030 etime=139 SRCH=Q
[download]

#!/usr/bin/perl
use strict;
use warnings;

my %hash;
my $conn;

open my $fh, '<', 'file1.txt' or die "failed: $!";
while (<$fh>) {
  while ( /conn=(\d+).*uid=(.*?),/g ) {
    $conn = $1;
    $hash{$conn} = $2;
  }
  my ($conn1) = map { $_ =~ /conn=(\d+).*SRCH=Q/ } <$fh>;

  print "$hash{$conn} => $conn\n" if grep /$conn1/, keys %hash;
}
close $fh;
[download]

Hope this helps:

use strict;
use warnings;
use Data::Dumper;

my %users;
my %searches;

#open my $fh, '<', 'file1.txt' or die "failed: $!";
while (<DATA>) { # I use DATA handle instead of $fh for convenience
        if( /BIND/ ) {
                my( $conn, $uid ) = /conn=(\d+).*uid=(.*?),/;
                $users{$uid} = $conn;
        }
        if( /SRCH=Q/ ) {
                my ($timestamp, $conn) = /\[(.*?)\] conn=(\d+)/;
                push @{$searches{$conn}}, $timestamp;
        }
}
#close $fh;

for my $user (keys %users) {
        print "User $user had ".scalar( @{$searches{$users{$user}}} ).
+" searches on connection ".$users{$user}."\n";
}

print Dumper \%users;
print Dumper \%searches;


__DATA__
[04/Jun/2013:13:06:13 -0600] conn=13570 op=14 msgId=13 - BIND dn="uid=
+xyz123,ou=People,o=xyz.com" method=128 version=3
[04/Jun/2013:15:06:13 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:15:06:14 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:15:06:15 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:15:06:16 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:15:06:17 -0600] conn=13570 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:17:06:13 -0600] conn=13571 op=14 msgId=13 - BIND dn="uid=
+xyz456,ou=People,o=xyz.com" method=128 version=3
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[04/Jun/2013:18:06:17 -0600] conn=13571 op=14 msgId=15 - RESULT err=0 
+tag=101 nentries=48030 etime=139 SRCH=Q
[download]

Hello HDB,

You output comes like this :

$VAR1 = {
          'xyz456' => '13571',
          'xyz123' => '13570'
        };
[download]

while I want :

$VAR1 = {
          'xyz123' => '13571',
                   '13570'
        };
[download]

Basically, what I want is to get conn# from SRCH string, go to the first hash, map with uid, lookup the value, if exist, count the # of values, if >3, print "bad user".

Thanks for all your effort.