AnsweredAssumed Answered

Using multiple Filter Expression with PI Datalink Compressed Data results in strange output

Question asked by Terpstrj on Jan 17, 2018
Latest reply on Jan 17, 2018 by Terpstrj

Hi All,

 

I'm using a PI datalink function called Compressed Data with the optional Fiter Expression.

But the query results are not logical and I cannot explain it. But it is repeatable.

I hope somebody could explain this to me?

 

The raw data that I do the query on is:

 

 

||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

 

1 The used filter expression is as follows:

Instr ('EventTag', "USER1  logged") AND Instr ('EventTag', "NODEA")

The query results are: (not a logical result, I would expect all 6 entires)

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

 

2 The used filter expression is as follows: (added the word out)

Instr ('EventTag', "USER1  logged out") AND Instr ('EventTag', "NODEA")

 

The query results are: (logical result)

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

 

3 The used filter expression is as follows: (added the word in)

Instr ('EventTag', "USER1  logged in") AND Instr ('EventTag', "NODEA")

 

The query results are: (not a logical result)

No more values:

 

4 The used filter expression is as follows: (added the word in and removed NODEA but the kept the AND instruction using a space)

Instr ('EventTag', "USER1  logged in") AND Instr ('EventTag', " ")

 

The query results are: (logical result)

 

||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

 

When looking at the results my first impression was that I'm missing a space somewhere at NODEA but this is not the case.

Do I do something wrong with this combined multi string fitler expression, because this is for me the first time I use 2 instr functions with an AND port?

Or are there better ways to do this search?

 

I hope anybody could help me.

 

Thanks

Jorgen.

 

Outcomes