[nycbug-talk] Text parsing question

[maddaemon at gmail.com]

On Mon, Dec 15, 2008 at 8:46 PM, Jan Schaumann <jschauma at netmeister.org> wrote:
> "maddaemon at gmail.com" <maddaemon at gmail.com> wrote:
>
>> Dec 15 05:15:56 - abc1234 tried logging in from 192.168.8.17
>> Dec 15 05:15:56 - abc1234 tried logging in from 192.168.18.13
>
> Split into timestamp, line and IP.  Use a hash:
>
> if $line matched "abc1234 tried logging in from"
>        if ! $line_by_ts{$timestamp}
>                $line_by_ts{$timestamp} = $ip
>        else
>                if $ip != $line_by_ts{$timestamp}
>                        # dupe with different ip
>                else
>                        # dupe with same ip
>                endif
>        endif
> endif
>
> awk or perl should do.
>
> -Jan

That looks like it might work, except for the fact that there are a
possible 300+ user IDs that might be in the list.  Is there a way in
this line:

if $line matched "abc1234 tried logging in from"

to use a variable instead of "abc1234"?