Hello, i've recently been struggling with SEC to implement something for this specific use case: suppressing specific entries read from a syslog for a certain amount of time (say 30min) but make sure that after a longer time (say 1h), if they are still being received, i'm getting a new one.
If these events are being received continously they will always be suppressed because the windows will be sliding accordingly but i'm trying to find a way to make it stop after 1h The sequence should look like this: T1---------------------------T27-----------T30-------------------T57-------------T60----------T61 Event suppr suppr suppr suppr suppr Event I tried combining a SingleWithSuppress (which is ok for the suppression part) and context expiration but i cannot find a working solution. Anybody already faced this use case ? Any help appreciated! Thanks and regards, Mugugno
_______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users