Hi Don,

Thanks for putting all your questions, really appreciate your effort. Here is my response to your questions :


What exactly is the output you want (using CODE tags) when your input contains 3 searches that occur in an hour and show us sample data that we can use as a test that actually contains data that would cause a report to be generated?

# re : As mentioned initially, the output will lead to execution of an internal command ( add group) - no output as such, however we can print the addition within the log. Basically, the intent is to add heavy search users within a restricted group. We need to pull out those users who perform more than 3 searches.


What determines the 1 hour time range:
3 BIND entries with timestamps <= 1 hour apart where the corresponding RESULT entries include SRCH=Q?
3 RESULT entries with SRCH=Q with timestamps <= 1 hour?
3 RESULT entries with SRCH=Q where the sum of the differences between the corresponding BIND and RESULT timestamps is >= 1 hour?
something else?

# re : 1 hour scan is to limit less log scanning, that's all. You can drop the hour part as of now, I am really interested in getting the logic first for the main issue.


Note that none of the 1st three elements in the above list will trigger a report with any of the sample data you have given us! (However, C would be met if you wanted to report a user using more than one hour of search time in three or fewer searches if we used the data provided in your initial post in this thread.)
Are all timestamps in non-decreasing order?
Are all timestamps in increasing order?
Are all timestamps in the same timezone?

# re : Don't bother about timestamp etc. The data which I provided is enough to create the condition. An output for less than too search will not trigger the execution of add group command. All timestamp will be in increasing order, and will be in same timezone.

Do we have to worry about shifts to and from daylight savings time?
Are all timestamps in an input file from the same day? If not, will there ever be:"
days that have no RESULT entries with SRCH=Q?
days that have no entries at all?
a time difference between a BIND time and a RESULT time of more than 23:59:59?
If a user has more than one 1 hour time period with 3 SRCH=Q RESULT entries:

re : We do not care about shifts or daylight saving time. If there are any heavy users, they will eventually get captured during the multiple runs, we don't care if we miss a couple of them due to daylight saving, etc.

Should there only be 1 occurrence reported for the user?
re : No, see my response below.

Should there be 1 occurrence reported for every set of 3 SRCH=Q RESULT entries that occur within an hour even if some of the SRCH=Q RESULT entries were used in an earlier report?

re : Yes, there should only 1 occurrence reported for every set of 3 SRCH=Q, once the user is added to the group, the server will not receive further request due to user being added to restricted group.

Should there be 1 occurrence reported for every set of 3 SRCH=Q RESULT entries that occur within an hour but only if none of the SRCH=Q RESULT entries were used in an earlier report?

re : see my response above.

Will every RESULT entry have a corresponding BIND entry?

re : Yes.

Could the corresponding BIND appear in a different log file? If the corresponding BIND is not found, should some kind of diagnostic be printed? (If so, exactly what should the diagnostic be?)

re: If corresponding BIND does not appear, we will not count that search, and have to drop the search.

Can there be more than one search in progress for a given user at any time? (I.e., can there be two or more BIND entries before the RESULT entry shows up corresponding to the first BIND entry?

re: Ideally, there will be only one BIND search at any given point of time.


Will conn=xxx always be in the 3rd field in every line?

re : yes.

Will "BIND" and "RESULT" always appear in the 7th field in every input line? If so, will the 7th field on any line ever contain anything other than "BIND" or "RESULT"?

re : yes. As shown within the logs, all fiels locations are static.

On RESULT lines that contain "SRCH=Q", will that string always be the last field on the line?

re : Yes.