it's not work.
please note that the subject field is in other event , it's a bit tricky
i will try to explain better -
for every mail, the mail gateway send a few syslog
1 with mail id and subject
1 with mail id and direction
and so on... for every mail the mail id is the same
i create ASP rule for every syslog
now i have 6 different ASP rules for this data source
so the problem is when i create rule with direction field the event doesn't contain the subject field and i don't know how to connect between them..
i hope its understood....
yeah, it will be difficult if at all do-able, as you are trying to match a particular field. Can you try group by Mail ID?