Hello,
The question is if I can get the last triggering event line when using rule
type SingleWithThreshold?
The match variable $0 gives the first event that started the correlation for
this rule but I would like to
get the last event that triggered the action for the rule and use that in the
rule action. In this case I would
just write the event to standard output.
I know I could do this using two rules and a context that holds the event but I
was wondering if there would
be some simpler way, without additional rules. Like, accessing the input buffer
or something like that.
Thanks
Roni
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
