in reply to Extracting useful information from Windows Event Logs

Before tye's reply made it redundant, I wrote a regex to parse the print message. FYI, it was:

my $digits_re = qr{ \d+ }msx; my $words_re = qr{ \S+ (?: \s+ \S+)* }msx; my $print_message_re = qr{ \A Document [ ] ( $digits_re ) , [ ] ( $words_re ) [ ] owned [ ] by [ ] ( $words_re ) [ ] was [ ] printed [ ] on [ ] ( $words_re ) [ ] via [ ] port [ ] ( $words_re ) \. [ ]+ Size [ ] in [ ] bytes: [ ] ( $digits_re ) ; [ ] pages [ ] printed: [ ] ( $digits_re ) \s* \z }msx;

Here is a cleaned-up and refactored solution to your problem.
Working, tested code:

#!/usr/bin/perl use strict; use warnings; use Win32::EventLog; use constant ONE_DAY => 24 * 60 * 60; my $yesterday = time() - ONE_DAY; my $wanted_date = format_date( $yesterday ); my $wanted_host = $ENV{ComputerName}; my $wanted_log = 'System'; my $wanted_source = 'Print'; print "Wanted Date : $wanted_date\n"; print "Wanted Host : $wanted_host\n"; print "Wanted Log : $wanted_log\n"; print "Wanted Source: $wanted_source\n"; my $handle = Win32::EventLog->new( $wanted_log, $wanted_host ) or die "Can't open '$wanted_log' EventLog from '$wanted_host'\n"; $handle->GetNumber( my $recs ) or die "Can't get number of EventLog records\n"; $handle->GetOldest( my $base ) or die "Can't get number of oldest EventLog record\n"; my $read_flags = EVENTLOG_FORWARDS_READ | EVENTLOG_SEEK_READ; foreach my $event_id ( $base .. ( $base + $recs - 1 ) ) { $handle->Read( $read_flags, $event_id, my $event_href ) or die "Can't read EventLog entry# $event_id\n"; next if $event_href->{Source} ne $wanted_source; my $event_date = format_date( $event_href->{'TimeGenerated'} ); next if $event_date ne $wanted_date; my ( $doc_num, $doc_name, $owner, $device, $port, $size, $pages ) = split "\x00", $event_href->{Strings}; printf( "%7d\t%15d\t%-15s\t%-7s\t%-23s\t%7d\t%s\n", $pages, $size, $owner, $port, $device, $doc_num, $doc_name, ); } sub format_date { die "Wrong number of arguments" if @_ != 1; my ($time) = @_; my ( $day, $month, $year ) = (localtime $time)[3..5]; return sprintf( '%04d-%02d-%02d', $year+1900, $month+1, $day ); }