This is a snapshot of the dataset

92 1 24 Dec 20 2005  2:14PM 1 14 2   sa tempdb   select * from sysusers
92 1 24 Dec 20 2005  2:14PM 1 14 2   sa tempdb   select * from master..sysprocesses
92 1 24 Dec 20 2005  2:14PM 1 14 2   sa tempdb   select * from sysusers
92 1 24 Dec 20 2005  2:14PM 1 14 2   sa tempdb   select * from master..sysprocesses
92 1 25 Dec 20 2005  2:14PM 1 14 2   sa tempdb   use tempdb
92 1 25 Dec 20 2005  2:14PM 1 14 2   sa tempdb   select * from sysusers
92 1 26 Dec 20 2005  2:14PM 1 14 2   sa tempdb   use tempdb
92 1 26 Dec 20 2005  2:14PM 1 14 2   sa tempdb   select @@version
92 1 26 Dec 20 2005  2:14PM 1 14 2   sa tempdb   
COMMIT TRAN

92 1 26 Dec 20 2005  2:14PM 1 14 2   sa tempdb   create table #ttt (foo varchar(20), bar int)
92 1 26 Dec 20 2005  2:14PM 1 14 2   sa tempdb   insert #ttt values('a string', 1)
92 1 26 Dec 20 2005  2:14PM 1 14 2  0001fb520002 sa tempdb   insert #ttt values('another string', 2)
92 1 26 Dec 20 2005  2:14PM 1 14 2  0001fb520002 sa tempdb   insert #ttt values('foodiboo', 3)
92 1 26 Dec 20 2005  2:14PM 1 14 2  0001fb520002 sa tempdb   
ROLLBACK TRAN

Here's the code

my $lastrunt = "Dec 20 2005  9:00AM";
my @sqlcmd;
$dbh->do("use sybsecurity");
$sth=$dbh->prepare("select * from sysobjects where name like 'sysaudits_%'");
$sth->execute;
while ($data = $sth->fetch) {
      push @sqlcmd,"select extrainfo from @$data where suid in (select a.suid from master..syslogins a, master..s
ysloginroles b where b.srid=0 and a.suid=b.suid and a.suid not in (1,8))) and event=92 and eventtime > '$lastrunt'";
      push @sqlcmd," union";
   }
pop @sqlcmd;

$sth=$dbh->prepare("@sqlcmd");
$sth->execute;
while ($data = $sth->fetch) {
   # print "@$data\n";
  if($data =~ /create/) { print "@$data\n"; }
}