Thanks for catching the typo, I've corrected the original post.

You are right to some extent, I'd missed the bit about identical refs. However the specs aren't clear and it is not obvious what the OP really wants to report.

A modification of the code to

while ( my $line = <$file> ) {
    next unless $line =~ /TWO/;
    my ($time, $ref) = $line =~ /^(\d\d\d\d-\w\w\w-\d\d \d\d)/).*refs 
+= (\d+)$/;
    ++$stats{$time}{$ref};
}
[download]

may suffice. It will keep a count of how many times each ref number occurs during each hour. Typically data is reported over fixed intervals of time and this approach certainly has the advantage of simplicity.