Update: Arg!! I just realised I completely misread. You want unique users, not IP's!
Update 2: Ok, fixed so that it returns Users rather than IP's

I was under the impression that the array is naturally split by a space ?

Yes, but you must implicitly call the split function.

In any case, a hash is probably more suited to this task. Here is one solution, using a hash for your unique IP's users, and a regex to pull them out of each line: 

#!/usr/bin/perl -w
use strict;
use Data::Dumper::Simple;

my %users;

while (<DATA>) {
    next unless /Login succeeded/;
    chomp;
    if (/User: ([\w]+),/) {
        $users{$1}++;
    }

}

print Dumper(%users);

__DATA__
00:00000:00014:2005/11/30 10:01:23.77 server  Configuration file '/opt
+/sybase/SERVER1.cfg' has been written and the previous version has be
+en renamed to '/opt/sybase/SERVER1.030'.
00:00000:00014:2005/11/30 10:01:23.80 server  The configuration option
+ 'log audit logon success' has been changed by 'sa' from '0' to '1'.
00:00000:00015:2005/11/30 10:01:37.36 Logon  Login succeeded. User: sa
+, Client IP address: '169.123.26.124'.
00:00000:00016:2005/11/30 10:10:50.91 Logon  Login succeeded. User: xy
+z, Client IP address: '169.123.26.124'.
00:00000:00017:2005/11/30 16:31:31.02 Logon  Login succeeded. User: sa
+, Client IP address: '169.123.26.124'.
00:00000:00020:2005/11/30 16:51:11.90 Logon  Login succeeded. User: sa
+, Client IP address: '169.123.26.124'.
00:00000:00021:2005/12/01 09:49:23.44 Logon  Login succeeded. User: ab
+c, Client IP address: '169.123.26.124'.
00:00000:00022:2005/12/01 09:49:23.90 Logon  Login succeeded. User: sa
+, Client IP address: '169.123.26.124'.
00:00000:00023:2005/12/01 09:51:29.65 kernel  Cannot read, host proces
+s disconnected: SERVER1  spid:23
00:00000:00025:2005/12/01 09:52:27.74 Logon  Login succeeded. User: sa
+, Client IP address: '169.123.26.124'.
00:00000:00026:2005/12/01 09:55:24.06 Logon  Login succeeded. User: qw
+r, Client IP address: '169.123.26.124'.
00:00000:00027:2005/12/01 09:55:47.15 Logon  Login succeeded. User: sa
+, Client IP address: '169.123.26.124'.
00:00000:00026:2005/12/01 10:02:25.95 server  Configuration file '/opt
+/sybase/SERVER1.cfg' has been written and the previous version has be
+en renamed to '/opt/sybase/SERVER1.031'.

[download]

Which gives: 

%users = (
           'qwr' => 1,
           'abc' => 1,
           'sa' => 6,
           'xyz' => 1
         );

[download]

Hope this helps,
Darren :)

In reply to Re: array processing by McDarren
in thread array processing by Anonymous Monk

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.