I would try the general approach of:
eval some marker field to capture
whether an event is 'event1',
'event2', 'eventA', or 'eventB'.
use transaction on the host name and log #
flatten the resulting multi-valued
marker field into a
string
use a regex on this flattened
field to match the
sequence you have listed there
This is an interesting problem, can you describe what the real-world incident is with these events?
... View more