in reply to Undefined Error

You need to check for the existence of $searches{$conn} before you use if as an array reference! ;) 

for my $user (keys %users) {
  for my $conn (@{$users{$user}}) {
    if( exists $searches{$conn} ) {
      print "User $user had ".scalar( @{$searches{$conn}} )." searches
+ on connection $conn\n";
      print "\t=> Bad user!\n" if  @{$searches{$conn}} > 3;
    }
  }
}

[download]

Replies are listed 'Best First'.
Re^2: Undefined Error (not exists)
by Anonymous Monk on Jun 15, 2013 at 07:45 UTC 
    if( my $soy = $searches{sauce} ){
  print int(@$soy);
}

    [download]
[reply]
[d/l]
Re^2: Undefined Error
by johnrein55 (Novice) on Jun 15, 2013 at 12:01 UTC
    Hi HDB,

    I am not getting an error, however the count part of the code is not working, have you tested it? 

    
print "\t=> Bad user!\n" if  @{$searches{$conn}} > 3;

    [download]
[reply]
[d/l]
      Can you explain "the code is not working" ?.
      The missing SRCH=Q means you will not get a line like this in the results with the code and data shown. 
      User xyz123 had 1 searches on connection 13573

      [download]
      poj
[reply]
[d/l]

      What do you expect as output for your dataset? I thought the following would be fine: 

      User xyz123 had 1 searches on connection 13570
User xyz123 had 1 searches on connection 13572
User someoneelse had 1 searches on connection 13571

      [download]
[reply]
[d/l]
        Well, I want to print "bad User" if count is greater than 3, that is the only output I want. 
        
print "\t=> Bad user!\n" if  @{$searches{$conn}} > 3;

        [download]
[reply]
[d/l]

        Actually, there is some issue with regex, where I am putting /^BIND$/ to match exact word, as there is another string "UNBIND".

        is this not the right way to match exact string /^BIND$/? Please let me know if it is not.

        Thanks,
[reply]

        Thank You, both works ( /b and /s). One last query related to this post, I would like to add time search, where the time has following format : 

        
[04/Jun/2013:15:06:13

        [download]

        I would like to scan the log for last one hour only whenever I run the script. Thanks for all your effort.

[reply]
[d/l]
        Thanks for your response. I do not have "DateTime::Format::Strptime" installed, and it is not possible to have the module installed. Any other alternative?
[reply]
        Hi Poj,

        I see that you've changed the logic, can you tell me know how to just disable the time part, so that I can run the script to verify the main logic.

        Thanks,
[reply]
        Hi Poj,

        I am only getting print statement for time, here is the output, i should get number of counts, and print statement as bad user. 

        

Now is 17/Jun/2013 404 mins
17/Jun/2013:06:12:37 -0600 = 17/Jun/2013 06 12 ; 372 <=> 404
17/Jun/2013:06:32:34 -0600 = 17/Jun/2013 06 32 ; 392 <=> 404
17/Jun/2013:06:32:46 -0600 = 17/Jun/2013 06 32 ; 392 <=> 404
17/Jun/2013:06:32:55 -0600 = 17/Jun/2013 06 32 ; 392 <=> 404
17/Jun/2013:06:33:28 -0600 = 17/Jun/2013 06 33 ; 393 <=> 404

        [download]
        Thanks.
[reply]
[d/l]
        Hi Poj,

        I regret, the script does print count, however the issue is that there are lot of logs, is there any way to put the hashes within file db, so that it is not consuming memory?

        Thanks.
[reply]

        I took the prod log, an hour log is of 200 MBs. Is that low/high?

        To be on safer side, I would like to dump the search onto the disk, and then perform the searches ( ie bind etc)

        what do you suggest?
[reply]

In Section Seekers of Perl Wisdom