Here is a quick and dirty script... if you want just the "Account Not Registered" and not the whole "F - Account Not Registered", you will need to parse the last field.
Please note: I am assuming a comma is the field delimiter.
#!/usr/bin/perl
use strict;
use warnings;
my $Data;
while(<DATA>)
{
chomp;
@_=split(',');
$Data->{$_[1]}->{$_[3]}++;
}
foreach my $User (sort keys %{$Data})
{
print 'User: ',$User,"\n";
foreach my $Error (sort keys %{$Data->{$User}})
{
print ' [',$Error,'] happened ',$Data->{$User}->{$Error},' time(s
+)',"\n";
}
}
__DATA__
2004/09/01:10:37:57,cbt54632,192.168.1.253,F - Account Not Registered
2004/09/01:10:37:57,cbt99999,192.168.1.253,F - Account Not Registered
2004/09/01:10:37:57,cbt54632,192.168.1.255,A - Some Other Error
2004/09/01:10:37:57,cbt99999,192.168.1.255,B - Yet Another Error
2004/09/01:11:37:57,cbt54632,192.168.1.253,F - Account Not Registered
I hope this helps!
-
Are you posting in the right place? Check out Where do I post X? to know for sure.
-
Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
<code> <a> <b> <big>
<blockquote> <br /> <dd>
<dl> <dt> <em> <font>
<h1> <h2> <h3> <h4>
<h5> <h6> <hr /> <i>
<li> <nbsp> <ol> <p>
<small> <strike> <strong>
<sub> <sup> <table>
<td> <th> <tr> <tt>
<u> <ul>
-
Snippets of code should be wrapped in
<code> tags not
<pre> tags. In fact, <pre>
tags should generally be avoided. If they must
be used, extreme care should be
taken to ensure that their contents do not
have long lines (<70 chars), in order to prevent
horizontal scrolling (and possible janitor
intervention).
-
Want more info? How to link
or How to display code and escape characters
are good places to start.