transaction search: how to determine unresolved "start of problem" events

[dianbo_1]

Hi,

In my application, i use a file to store problems: when happen and when resolve. When a problem happen, more that one device will find it and record the information. But when a problem is solved, just one message is written to that log file.

For example, a segment of the log file is as the following:

2010/07/01 08:01:00 AAA [err] complains "can not find the apple 0001"
2010/07/01 08:01:00 BBB [err] complains "apple 0001 is not there"
2010/07/01 08:01:01 CCC [err] complains "apple 0001 is moved to a new place"
......
2010/07/01 08:02:00 Main[info] broadcasts "apple 0001 is placed to the right place"

Now, I want to get those unresolved problems.

I used transaction to do this before, and use startwith="can not find " OR "is not there" OR "is moved to a new place". But just as in the example, the first event ("can not find the apple 0001") is treated as an unresolved problem.

Any questions for this question?

Thanks & Regards,

Dianbo

[gkanapathy]

Seems to me that you need transaction on whatever field contains "apple 0001" and an "endswith" of the conclusion, then just keep evicted transactions and report only on the evicted ones.

[Simeon]

From your sample, it sounds as though "apple 0001" in combination with a NOT operator for "placed to the right place" could find the right transaction. Without exact event details this cannot be answered very well.

[Simeon]

Your question is very unclear. Can you provide examples of the transaction you know is successful, and which ones are NOT successful (resolution wise).