http://www.perlmonks.org?node_id=387964


in reply to Counting In a Log File from Multiple Variables

Here is a quick and dirty script... if you want just the "Account Not Registered" and not the whole "F - Account Not Registered", you will need to parse the last field.

Please note: I am assuming a comma is the field delimiter. 

#!/usr/bin/perl

use strict;
use warnings;

my $Data;

while(<DATA>)
{
  chomp;
  @_=split(',');
  $Data->{$_[1]}->{$_[3]}++;
}

foreach my $User (sort keys %{$Data})
{
  print 'User: ',$User,"\n";
  foreach my $Error (sort keys %{$Data->{$User}})
  {
    print '  [',$Error,'] happened ',$Data->{$User}->{$Error},' time(s
+)',"\n";
  }
}


__DATA__
2004/09/01:10:37:57,cbt54632,192.168.1.253,F - Account Not Registered
2004/09/01:10:37:57,cbt99999,192.168.1.253,F - Account Not Registered
2004/09/01:10:37:57,cbt54632,192.168.1.255,A - Some Other Error
2004/09/01:10:37:57,cbt99999,192.168.1.255,B - Yet Another Error
2004/09/01:11:37:57,cbt54632,192.168.1.253,F - Account Not Registered

[download]

I hope this helps!

Replies are listed 'Best First'.
Re^2: Counting In a Log File from Multiple Variables
by japhy (Canon) on Sep 02, 2004 at 16:09 UTC
    I think you'll be a whole lot happier when you start writing 
    print "User: $User\n";
print "  [$Error] happened $Data->{$User}{$Error} time(s)\n";

    [download]
    _____________________________________________________
    Jeff japhy Pinyan, P.L., P.M., P.O.D, X.S.: Perl, regex, and perl hacker
    How can we ever be the sold short or the cheated, we who for every service have long ago been overpaid? ~~ Meister Eckhart
[reply]
[d/l]
      I think about that all the time. *Smiles* When I started writing perl code, I made some mistakes with "" and '', so I started putting literals in '', special characters (like \t and \n) in "", and I pulled out all variables.

      It's just one of those habits which has stuck around in my code since.

[reply]
Re^2: Counting In a Log File from Multiple Variables
by monger (Friar) on Sep 02, 2004 at 19:08 UTC
    Thanks Rhose. This has it started.

    I did some mods to the code for my environment, and not being fluent yet in HoHs, or any more advanced data structures, I'm going to throw back my mods and plea for aid. I've looked at the perldsc, but I'm still a bit fuzzy. Heading in the right direction, but need a bit more of a push. Here the code:

    #!/usr/bin/perl

use strict;
use warnings;


my $line;
my $Error;
my $Data;
my $File  = "L:\\cybor\\20040831.log";
open FILE, $File || die "Can't open log file: $!";

while(<FILE>)
{
#  chomp;
    #@_=split(',');
  foreach $line (<FILE>) {
      @_=split(',');
  $Data->{$_[1]}->{$_[3]}++;
  }
}

foreach my $User (sort keys %{$Data})
{
    print 'User: ',$User,"\n";
    foreach my $Error (sort keys %{$Data->{$User}})
    {
    print '  [',$Error,'] happened ',$Data->{$User}->{$Error},' time(s
+)',"\n";
    }
}

    [download]

    Here's the output from cygwin:

    User: wfmccahi
  [P - Password Reset
] happened 172 time(s
+)

    [download]

    So, it's not counting quite right. The phrase "P - Password Reset" only occurs four times in the file in question. Any suggestions?

    Thanks, monger

    Monger +++++++++++++++++++++++++ Munging Perl on the side
[reply]
[d/l]
[select]
      I would change: 

      while(<FILE>)
{
#  chomp;
    #@_=split(',');
  foreach $line (<FILE>) {
      @_=split(',');
  $Data->{$_[1]}->{$_[3]}++;
  }
}

      [download]

      to 

      while(<FILE>)
{
  chomp;
  @_=split(',');
  $Data->{$_[1]}->{$_[3]}++;
}

      [download]

      The "chomp" will get rid of that pesky newline you are seeing in the output. Also, the "while(<FILE>)" will process each line of your file (one at a time) and will assign each line to $_. This means your "foreach $line (<FILE>)" is not needed.

      Note: The foreach loop in your code would assign data to the $line variable. Your split is splitting $_ (nothing specified mean you get to use the default $_)... if you were to use your foreach, you would want to change your split to "@_=split(',',$line);"

[reply]
[d/l]
[select]
        Thanks Rhose. Worked like a charm. Now to look at expanding to count some more fields. Now my feet are a bit wetter, I think I'm in business! monger
        Monger +++++++++++++++++++++++++ Munging Perl on the side
[reply]

In Section Seekers of Perl Wisdom