Re: Counting In a Log File from Multiple Variables

[Rhose]

in reply to Counting In a Log File from Multiple Variables

Here is a quick and dirty script... if you want just the "Account Not Registered" and not the whole "F - Account Not Registered", you will need to parse the last field.

Please note: I am assuming a comma is the field delimiter.

#!/usr/bin/perl

use strict;
use warnings;

my $Data;

while(<DATA>)
{
  chomp;
  @_=split(',');
  $Data->{$_[1]}->{$_[3]}++;
}

foreach my $User (sort keys %{$Data})
{
  print 'User: ',$User,"\n";
  foreach my $Error (sort keys %{$Data->{$User}})
  {
    print '  [',$Error,'] happened ',$Data->{$User}->{$Error},' time(s
+)',"\n";
  }
}


__DATA__
2004/09/01:10:37:57,cbt54632,192.168.1.253,F - Account Not Registered
2004/09/01:10:37:57,cbt99999,192.168.1.253,F - Account Not Registered
2004/09/01:10:37:57,cbt54632,192.168.1.255,A - Some Other Error
2004/09/01:10:37:57,cbt99999,192.168.1.255,B - Yet Another Error
2004/09/01:11:37:57,cbt54632,192.168.1.253,F - Account Not Registered

I hope this helps!

[japhy]

I think you'll be a whole lot happier when you start writing

print "User: $User\n";
print "  [$Error] happened $Data->{$User}{$Error} time(s)\n";

[Rhose]

I think about that all the time. *Smiles* When I started writing perl code, I made some mistakes with "" and '', so I started putting literals in '', special characters (like \t and \n) in "", and I pulled out all variables.

It's just one of those habits which has stuck around in my code since.

[monger]

Thanks Rhose. This has it started.

I did some mods to the code for my environment, and not being fluent yet in HoHs, or any more advanced data structures, I'm going to throw back my mods and plea for aid. I've looked at the perldsc, but I'm still a bit fuzzy. Heading in the right direction, but need a bit more of a push. Here the code:

#!/usr/bin/perl

use strict;
use warnings;


my $line;
my $Error;
my $Data;
my $File  = "L:\\cybor\\20040831.log";
open FILE, $File || die "Can't open log file: $!";

while(<FILE>)
{
#  chomp;
    #@_=split(',');
  foreach $line (<FILE>) {
      @_=split(',');
  $Data->{$_[1]}->{$_[3]}++;
  }
}

foreach my $User (sort keys %{$Data})
{
    print 'User: ',$User,"\n";
    foreach my $Error (sort keys %{$Data->{$User}})
    {
    print '  [',$Error,'] happened ',$Data->{$User}->{$Error},' time(s
+)',"\n";
    }
}

Here's the output from cygwin:

User: wfmccahi
  [P - Password Reset
] happened 172 time(s
+)

So, it's not counting quite right. The phrase "P - Password Reset" only occurs four times in the file in question. Any suggestions?

Thanks, monger

[Rhose]

I would change:

while(<FILE>)
{
#  chomp;
    #@_=split(',');
  foreach $line (<FILE>) {
      @_=split(',');
  $Data->{$_[1]}->{$_[3]}++;
  }
}

to

while(<FILE>)
{
  chomp;
  @_=split(',');
  $Data->{$_[1]}->{$_[3]}++;
}

The "chomp" will get rid of that pesky newline you are seeing in the output. Also, the "while(<FILE>)" will process each line of your file (one at a time) and will assign each line to $_. This means your "foreach $line (<FILE>)" is not needed.

Note: The foreach loop in your code would assign data to the $line variable. Your split is splitting $_ (nothing specified mean you get to use the default $_)... if you were to use your foreach, you would want to change your split to "@_=split(',',$line);"

[monger]

Thanks Rhose. Worked like a charm. Now to look at expanding to count some more fields. Now my feet are a bit wetter, I think I'm in business! monger