comp.lang.ruby

Stuart Clarke

12/18/2008 2:49:00 PM

Sorry for not being clear. I am actually parsing data from Windows event
logs and as a result the data is held in structured fields. Earlier in
my program I load the contents of a number of event logs into an array
and then ready the data using structs for example to read the ID number
- event.event_id more complicated for descriptions -
event.description[/Name:\t(.+?)\r\n/, 1]}

So what I would like to do is read my event log array and check for
specific event ID's (if event.event_id == 100).

If the if statement finds the ID 100 it reads name from
event.description. Everything mention thus far is working correctly.

When this is complete I then want to do a count on how many times each
name occurs e.g. bob = 2, sue = 12.
My thoughts were to load the event.description[/name:/] into a hash and
then do a count on each name in the hash and print it out.

Does this make more sense??


Dan Diebolt wrote:
> I am having a difficult time understanding what you are asking, but
> perhaps this will help:
>
> lines = <<EOF
> 100|data B|data C|data D|data E:Name:bob
> 200|data B|data C|data D|data E:Name:sue
> 200|data B|data C|data D|data E:Name:tim
> 200|data B|data C|data D|data E:Name:tim
> EOF
>
> names=Hash.new(0)
> lines.each do |line|
>   a,b,c,d,e=line.chomp.split("|")
>   names[e[/Name:([a-z]+)/,1]] += 1 if a=="200"
> end
>
> names
>
> => {"tim"=>2, "sue"=>1}

--
Posted via http://www.ruby-....