I would like to set up a log file template with duplicate message supression active. The arm message in the file must have a count of 50 within a period of 30 mins before a critical event be generated. If I get a clear entry in the file I need to reset the counter to zero that is running in the background on the critical arm message. In other words I should only get a critical event after 50 consequestive arm messages in the file in a period of 30 mins. If a clear entry is written to the file in that 30 mins the count and time should reset to zero and start the cycle again.
If anyone has done something like this without using ecs or external scripting please give me some pointers. Any help greatly appreciated.