1 Reply Latest reply on Jan 17, 2018 1:21 PM by Terpstrj

    Using multiple Filter Expression with PI Datalink Compressed Data results in strange output

    Terpstrj
    Terpstrj Jan 17, 2018 11:29 AM

      Hi All,

       

      I'm using a PI datalink function called Compressed Data with the optional Fiter Expression.

      But the query results are not logical and I cannot explain it. But it is repeatable.

      I hope somebody could explain this to me?

       

      The raw data that I do the query on is:

       

       

      ||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

      ||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

      ||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

      ||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

      ||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

      ||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

       

      1 The used filter expression is as follows:

      Instr ('EventTag', "USER1  logged") AND Instr ('EventTag', "NODEA")

      The query results are: (not a logical result, I would expect all 6 entires)

      ||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

      ||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

      ||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

       

      2 The used filter expression is as follows: (added the word out)

      Instr ('EventTag', "USER1  logged out") AND Instr ('EventTag', "NODEA")

       

      The query results are: (logical result)

      ||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

      ||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

      ||USER1  logged out as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

       

      3 The used filter expression is as follows: (added the word in)

      Instr ('EventTag', "USER1  logged in") AND Instr ('EventTag', "NODEA")

       

      The query results are: (not a logical result)

      No more values:

       

      4 The used filter expression is as follows: (added the word in and removed NODEA but the kept the AND instruction using a space)

      Instr ('EventTag', "USER1  logged in") AND Instr ('EventTag', " ")

       

      The query results are: (logical result)

       

      ||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

      ||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

      ||USER1  logged in as Application User||NOT ENABLED|NOT ACTIVE||||OPERATOR   |LOW|ALL|NODEA|||||

       

      When looking at the results my first impression was that I'm missing a space somewhere at NODEA but this is not the case.

      Do I do something wrong with this combined multi string fitler expression, because this is for me the first time I use 2 instr functions with an AND port?

      Or are there better ways to do this search?

       

      I hope anybody could help me.

       

      Thanks

      Jorgen.