association help needed!

[#1]

Hi guys,

I'm hoping you can hep with my query. I'm looking to associate events as outlined below:

StartDate	node	varname	SeverityDesc
05/11/2008 14:18:38	A	B	WARN
05/11/2008 14:19:38	A	B	CRITICAL
05/11/2008 14:19:58	A	B	OK
05/11/2008 14:19:38	B	B	CRITICAL
05/11/2008 14:19:58	B	B	OK

If a WARN is found for a node and varname then the next CRITICAL or OK should be associated with it.

If a CRITICAL is found the next OK should be associated with it.

I am trying to calculate the duration of the event from WARN or CRITICAL to OK

Any thoughts guys?

Thanks for help:

bc

[johnw]

There's probably a better way, but the attached seems to work.