HPMST Honored Contributor.
Honored Contributor.
181 views

create new event if two different events received in 10 minutes

Jump to solution

Dear all,

I want to create new event if i recieved two differnet events within 10 minutes ? How can I do this 

for example 

I have log file policy and I have two differnet matching pattern and I want to create new event if I recieved both the matching pattern within 10 minutes.

I try stream based correlation but when I try to create the filter it match in case same event happened two times. but I need in case the two different events in 10 minutes

 

0 Likes
1 Solution

Accepted Solutions
Highlighted
Micro Focus Expert
Micro Focus Expert

Re: create new event if two different events received in 10 minutes

Jump to solution

Hello,

What kind of SBEC rule do you use? Repetition? Probably you need to use a combination SBEC rule.

Regards,

Rosen

Micro Focus Software Support
The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of Micro Focus.
If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.
2 Replies
Highlighted
Micro Focus Expert
Micro Focus Expert

Re: create new event if two different events received in 10 minutes

Jump to solution

Hello,

What kind of SBEC rule do you use? Repetition? Probably you need to use a combination SBEC rule.

Regards,

Rosen

Micro Focus Software Support
The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of Micro Focus.
If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.
HPMST Honored Contributor.
Honored Contributor.

Re: create new event if two different events received in 10 minutes

Jump to solution

Dear Rosen,

 

thanks alot for your support

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.