Hello,
i've recently been struggling with SEC to implement something for this specific
use case: suppressing specific entries read from a syslog for a certain amount
of time (say 30min) but make sure that after a longer time (say 1h), if they
are still being received, i'm getting a new one.
If these events are being received continously they will always be suppressed
because the windows will be sliding accordingly but i'm trying to find a way to
make it stop after 1h
The sequence should look like this:
T1---------------------------T27-----------T30-------------------T57-------------T60----------T61
Event suppr suppr suppr suppr suppr
Event
I tried combining a SingleWithSuppress (which is ok for the suppression part)
and context expiration but i cannot find a working solution.
Anybody already faced this use case ?
Any help appreciated!
Thanks and regards,
Mugugno
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
