Closed fengjian1993 closed 2 years ago
solved
from every(A = O[str:contains(log, 'A')]<1:> -> B = O[str:contains(log, 'B') and A.sourceIp == B.sourceIp and B.eventTime - A.eventTime < 10000]) select A[last].sourceIp as sourceIp, A[last].log as logA, B.log as logB, A[last].eventTime as eventTimeA, B.eventTime as eventTimeB insert into AB;
Description:
Affected Siddhi Version:
OS, DB, other environment details and versions:
Steps to reproduce:
for input
it outpur
How can i just get [1.1.1.1, A, B, 11000, 12000] as result
Related Issues: