Trigger Operation

Trigger is used to specify a number of events for a user-specified duration.

The syntax for trigger is:

Trigger (<number of events>, <evaluation period>[, discriminator (<list of metatags>))

Where

<number of events> is an integer value specifying the number of matching events that are necessary for the rule to fire

<evaluation period> specifies the duration for which past events matching the filter expression are maintained, specified in seconds (s), minutes (m), or hours (h). If no letter is specified, seconds are assumed.

discriminator is a field to group by

For example, this rule detects if 5 events with the same source IP address happen within 10 seconds.

trigger(5,10,discriminator(e.sip))