Having read the thread another time, I think I kind of understand what you want to do.

Here's what I think:

You have a log file, three fields per record, one record per line. First field is a timestamp, second field an ID or case number, last field a transistion of the case. Valid states are "open", "hold" and "closed". You want to sum, for each case, the time the case is "open", that is, neither "closed", nor on "hold".

I've some untested partial code to do this. It's important to note that for this calculation, "hold" and "closed" are equivalent. Only relevant states are "open" and non-"open". The code assumes a parse_me subroutine that parses a line, and returns three values: a timestamp in seconds since some epoch, a case ID, and a state.

    my %info;
    while (<>) {
        my ($time, $id, $state) = parse_me ($_);
        unless ($info {$id}) {
            next unless $state eq 'open';
            $info {$id} = [$state, $time, 0];
            next;
        }
        if ($state eq 'open') {
            next unless $info {$id} -> [0] eq 'open';
            $info {$id} -> [0] = 'open';
            $info {$id} -> [1] = $time;
            next;
        }
        next unless $info {$id} -> [0] eq 'open';
        # This means the previous state was "open", and the current
        # state is "hold" or "closed". Increment the time.
        $info {$id} -> [2] += $time - $info {$id} -> [1];
        $info {$id} -> [0]  = $state;
        $info {$id} -> [1]  = $time;  # Not really needed.
    }

    # Finally, for all "open" cases, add the time since it went   
    # "open" till now.
    my $time = time;
    while (my ($id, $info) = each %info) {
        next unless $info -> [0] eq 'open';
        $info -> [2] += $time - $info -> [1];
    }
[download]

Now, for each ID, the total open time is found in $info {$ID} -> [2].

-- Abigail