That still doesn't seem to contradict gaal's approach, and only differs from mantadin's in choosing when and how to report. If I'm missing something, then tell me what is wrong with 
  my $REPORT_INTERVAL = 300; # seconds
  my %active = ( 'split' => 0, 'filter' => 0);
  my $next_report = date_to_timestamp("...start of day...");
  my $last_report = date_to_timestamp("...end of day...");
  while(<>) {
    # Parse out the fields
    my ($date, $action, $jobtype, $logfile) = /.../;

    # Update current active job counts
    if ($action eq 'start') {
      ++$active{$jobtype};
    elsif ($action eq 'finish') {
      --$active{$jobtype};
    } else {
      die "Huh? $_";
    }

    # Output counts for all report lines between
    # the last printed report and the time of this
    # log line. Most of the time, this will be empty
    # because we won't have reached the next report
    # time yet.
    my $stamp = date_to_timestamp($date);
    while ($stamp > $next_report) {
      report_counts($next_report, \%active);
      $next_report += $REPORT_INTERVAL;
    }
  }

  # Finish off the report for the report periods
  # at the end of the reporting range.
  while ($next_report < $last_report) {
    report_counts($next_report, \%active);
    $next_report += $REPORT_INTERVAL;
  }

[download]

Based on your proposed solution, it seems like you think that you have to correlate a finish event with the start event for that job -- but if all you want is the counts, then as gaal said, the correlation is unnecessary.

If for some reason you do need to correlate them, then you can always keep all active jobs' state in the %active hash: 

  ...
  if ($action eq 'start') {
    $active{$jobtype}{$logfile} = 1;
  } elsif ($action eq 'finish') {
    delete $active{$jobtype}{$logfile};
  }
  ...
  my $split_count = keys %{ $active{'split'} };
  ...

[download]

In reply to Re^3: Counting concurrent event jobs by sfink
in thread Counting concurrent event jobs by vagnerr

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.