I want to suppress a recurring 4 line event which is of no importance to me but is tripping my other rules.
Ok, so just use suppression like I do elsewhere I thought, however.... I don't want to suppress the lines individually, I only want to suppress them when all 4 lines occur within 2 seconds of each other and I want either all 4 suppressed or none of the 4 suppressed. So I tried a multiline regex suppression but this only suppressed the 4th line, the other 3 still turn up in in the next rules. Then I thought I'd try building contexts for each line so successive rules could reference them, but in testing this suffered from the same problems as above. The issue I think is that input lines are passed along to other rules for evaluation and are acted upon before the 4 line to complete any correlation can be seen. If I recall correctly, this is normal behaviour to pass lines on for immediate evaluation by other rules but it leaves me wondering how to suppress these 4 line events... but not to suppress each individual line which may have some significance if found without the other lines... Any ideas? -h -- Hari Sekhon ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
