You want to know all ip's for which the sent status occured, but not the created status. Here is one easy way. Use a bit for "created" and a bit for "sent" as values in a hash keyed on ip address. Print that key if only the "sent status" bit is set ("created" never occurred).

The scheme below can be expanded to any combination of "sent" and "created" that you need although the logic needs to change a bit if you want ip's that never had either "sent" or "created". 

#!/usr/bin/perl

use strict;
use warnings;

my %hash;
my $sent_bits    = 1;  # binary 0001
my $created_bits = 2;  # binary 0010

while(<DATA>)
{
    next if /^\s*$/;  #skip blank lines
    my ($srcip, $action_field) = (split /\s+/,$_)[1,4];
    (my $action) = $action_field =~ m/^\[\d+\](\w+)/;

    $hash{$srcip} |= $sent_bits    if ($action eq "sent");
    $hash{$srcip} |= $created_bits if ($action eq "created");  
}

foreach my $sent_or_created (keys %hash)
{
    print "$sent_or_created\n" 
        if ($hash{$sent_or_created} == $sent_bits);
}

#prints: 192.168.7.16



__DATA__
ex100525.log:09:42:26 192.168.66.176 webcountry 192.168.0.166 [5933]cr
+eated /140NOE77111_V460_+IE38/FTP+script/put771.ftp 226 0
ex100525.log:09:42:27 192.168.66.176 webcountry 192.168.0.166 [5933]cr
+eated /140NOE77111_V460_+IE38/FTP+script/update_noe77111_module.doc 2
+26 0
ex100525.log:09:42:27 192.168.66.176 webcountry 192.168.0.166 [5933]cr
+eated /140NOE77111_V460_+IE38/FTP+script/upfwnoe.bat 226 0
ex100525.log:09:42:27 192.168.66.176 webcountry 192.168.0.166 [5933]CW
+D /140NOE77111_V460_+IE38/Release+Note 550 2
ex100525.log:09:42:27 192.168.66.176 webcountry 192.168.0.166 [5933]CW
+D /140NOE77111_V460_+IE38/Release+Note 250 0
ex100525.log:09:42:27 192.168.66.176 webcountry 192.168.0.166 [5933]se
+nt /140NOE77111_V460_+IE38/Release+Note/RN_140NOE77111_V46.doc 226 0
ex100525.log:09:42:27 192.168.7.16 webcountry 192.168.0.166 [5933]sent
+ /140NOE77111+V4.6/140NOE77111_V460_+IE38 250 0
ex100525.log:09:42:27 192.168.7.16 webcountry 192.168.0.166 [5933]CWD 
+/140NOE77111+V4.6/140NOE77111_V460_+IE38 250 0

[download]

In reply to Re: Match a Log Entry Only If a Certain Keyword is not Present by Marshall
in thread Match a Log Entry Only If a Certain Keyword is not Present by Dru

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.