Searching for transaction demarked by paired events

[mightyscotchpin]

I've got a search problem that I've been trying to solve with some combination of transactions and events.

Hi all. I am trying search for a specific incident in one of our sources. The characteristics of the incident are:

1. starts with a specific pair of lines, in order (event 1 & 2)
2. A single occurrence of event A is found in between.
3. A single occurrence of event B is found in between.
4. event A & B can be in any order
5. ends with a specific pair of lines, in order (event 1 & 2)
6. All the events in a single incident have the same host name and log #.

Example:
hostA log2 event 1
hostA log2 event 2
hostA log2 event A
hostA log2 event B
hostA log2 event 1
hostA log2 event 2

Any suggestions on the best way to capture these incidents?

As I said, I have tried transactions, events and eventtypes, with no luck so far.

Thanks in advance for any advice.

[Dan]

I would try the general approach of:

1. eval some marker field to capture whether an event is 'event1', 'event2', 'eventA', or 'eventB'.
2. use transaction on the host name and log #
3. flatten the resulting multi-valued marker field into a string
4. use a regex on this flattened field to match the sequence you have listed there

This is an interesting problem, can you describe what the real-world incident is with these events?