title: sed: using variables across multiple lines
body: <p>I am attempting to "grep" out bind for a specific user from an LDAP log file. The lines I need will be spread across multiple lines in the log. Here is example input:</p>
  
  <pre><code>[2009/04/28 17:04:42.414] DoBind on connection 0x7c8affc0
  [2009/04/28 17:04:42.414] Bind name:cn=admin,ou=appids,o=admineq, version:3, authentication:simple
  [2009/04/28 17:04:42.415] Failed to authenticate local on connection 0x6cc8ee80, err = log account expired (-220)
  [2009/04/28 17:04:42.416] Sending operation result 53:"":"NDS error: log account expired (-220)" to connection 0x6cc8ee80
  [2009/04/28 17:04:42.416] Operation 0x3:0x60 on connection 0x6cc8ee80 completed in 3 seconds
  [2009/04/28 17:04:42.416] Sending operation result 0:"":"" to connection 0x7c8affc0
  [2009/04/28 17:04:42.416] Operation 0x1:0x60 on connection 0x7c8affc0 completed in 0 seconds
  [2009/04/28 17:04:48.772] DoSearch on connection 0x7c8affc0
  [2009/04/28 17:04:48.772] Search request:
  base: "o=intranet"
  scope:2  dereference:0  sizelimit:0  timelimit:600  attrsonly:0
  filter: "(guid='03ADmin)"
  attribute: "cn"
  attribute: "cn"
  attribute: "cn"
  attribute: "cn"
  attribute: "objectClass"
  attribute: "guid"
  attribute: "mail"
  [2009/04/28 17:04:48.773] Sending operation result 0:"":"" to connection 0x7c8affc0
  [2009/04/28 17:04:48.773] Operation 0xe851:0x63 on connection 0x7c8affc0 completed in 0 seconds
  </code></pre>
  
  <p>For this example the following should be the result:</p>
  
  <pre><code>[2009/04/28 17:04:42.414] DoBind on connection 0x7c8affc0
  [2009/04/28 17:04:42.414] Bind name:cn=admin,ou=appids,o=admineq, version:3, authentication:simple
  [2009/04/28 17:04:42.416] Sending operation result 0:"":"" to connection 0x7c8affc0
  [2009/04/28 17:04:42.416] Operation 0x1:0x60 on connection 0x7c8affc0 completed in 0 seconds
  </code></pre>
  
  <p>Basically, this is a log of server operations across multiple connections. I need to analyze the time spent in 'bind' operations by the admin user, but this server is very busy so I need to eliminate a lot of noise.</p>
  
  <p>In pseudocode:</p>
  
  <pre><code>for each line in file
      if line contains "DoBind" and next line contains "cn=admin"
          print both lines
          find the connection number X in lines
          skip lines until "Sending operation result.*to connection X" is found
          print two lines
  </code></pre>
  
  <p>I would like to get the "DoBind" lines which are preceeded by the user "cn=admin" and then the result lines, which are listed according to the connection number "0x7c8affc0" in this example. Other operations may take place between the beginning and end of the bind which I do not need, such as the "Failed to authenticate" message, which is taking place on a different connection.</p>
  
  <p>Furthermore, other operations will take place on the connection after the bind is done which I'm not interested in. In the above, the results of the DoSearch operation happening after the 'bind' must not be captured.</p>
  
  <p>I'm trying to do this with 'sed', which seemed like the right tool for the job. Alas, though, I'm a beginner and this is a learning experience. Here's what I have so far:</p>
  
  <pre><code>/.*DoBind on connection \(0x[0-9a-f]*\)\n.*Bind name:cn=OblixAppId.*/ p
  /.*Sending operation result.*to connection \1\nOperation.*on connection \1 completed.*/ p
  </code></pre>
  
  <p>sed complains about the second line where I use '\1'. I'm trying to capture the connection address and use it in a subsequent search to capture the result strings, but I'm obviously not using it correctly. The '#' variables seem to be local to each search operation.</p>
  
  <p>Is there a way to pass "variables" from one search to another or should I be learning perl instead?</p>