Here is a quick and dirty script... if you want just the "Account Not Registered" and not the whole "F - Account Not Registered", you will need to parse the last field.
Please note: I am assuming a comma is the field delimiter.
#!/usr/bin/perl
use strict;
use warnings;
my $Data;
while(<DATA>)
{
chomp;
@_=split(',');
$Data->{$_[1]}->{$_[3]}++;
}
foreach my $User (sort keys %{$Data})
{
print 'User: ',$User,"\n";
foreach my $Error (sort keys %{$Data->{$User}})
{
print ' [',$Error,'] happened ',$Data->{$User}->{$Error},' time(s
+)',"\n";
}
}
__DATA__
2004/09/01:10:37:57,cbt54632,192.168.1.253,F - Account Not Registered
2004/09/01:10:37:57,cbt99999,192.168.1.253,F - Account Not Registered
2004/09/01:10:37:57,cbt54632,192.168.1.255,A - Some Other Error
2004/09/01:10:37:57,cbt99999,192.168.1.255,B - Yet Another Error
2004/09/01:11:37:57,cbt54632,192.168.1.253,F - Account Not Registered
I hope this helps!