Using multiple Filter Expression with PI Datalink Compressed Data results in strange output

Hi All,

I'm using a PI datalink function called Compressed Data with the optional Fiter Expression.

But the query results are not logical and I cannot explain it. But it is repeatable.

I hope somebody could explain this to me?

The raw data that I do the query on is:

||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

1 The used filter expression is as follows:

Instr ('EventTag', "USER1  logged") AND Instr ('EventTag', "NODEA")

The query results are: (not a logical result, I would expect all 6 entires)

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

2 The used filter expression is as follows: (added the word out)

Instr ('EventTag', "USER1  logged out") AND Instr ('EventTag', "NODEA")

The query results are: (logical result)

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

3 The used filter expression is as follows: (added the word in)

Instr ('EventTag', "USER1  logged in") AND Instr ('EventTag', "NODEA")

The query results are: (not a logical result)

No more values:

4 The used filter expression is as follows: (added the word in and removed NODEA but the kept the AND instruction using a space)

Instr ('EventTag', "USER1  logged in") AND Instr ('EventTag', " ")

The query results are: (logical result)

||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

When looking at the results my first impression was that I'm missing a space somewhere at NODEA but this is not the case.

Do I do something wrong with this combined multi string fitler expression, because this is for me the first time I use 2 instr functions with an AND port?

Or are there better ways to do this search?

I hope anybody could help me.

Thanks

Jorgen.