SNMP Trap Item - Detect two parts of same trap

[astro_Avery]

What is the syntax to have snmptrap[] detect two different parts of the same trap? If you need more info, my situation is detailed below:

I need to set up a trigger that is true when I get a trap formatted like this:

(DATE/TIME) ZBXTRAP (IP) DISMAN-EVENT-MIB::sysUpTimeInstance = 175876500 SNMPv2-MIB::snmpTrapOID.0 = ETV-AlarmTrap-MIB::alarmMajor ETV-AlarmTrap-MIB::trapSequence2 = 1044 ETV-AlarmTrap-MIB::referenceNumberT2 = Wrong Type (should be Gauge32 or Unsigned32): 523 ETV-AlarmTrap-MIB::positionNumberT2 = Wrong Type (should be Gauge32 or Unsigned32): 1 ETV-AlarmTrap-MIB::portNumberT2 = Wrong Type (should be Gauge32 or Unsigned32): 0 ETV-AlarmTrap-MIB::alarmIdT2 = 1016 ETV-AlarmTrap-MIB::alarmTypeT2 = 3 ETV-AlarmTrap-MIB::alarmTextT2 = Video Not Running ETV-AlarmTrap-MIB::sourceTextT2 = RX8000 ETV-AlarmTrap-MIB::severityLevelT2 = 5 SNMPv2-MIB::snmpTrapEnterprise.0 = ETV-Base-MIB::mibEricssonTelevision

And then resolves when a very similar trap is received, only difference "ETV-AlarmTrap-MIB::alarmMajor" is now "ETV-AlarmTrap-MIB::alarmNormal." Unfortunately, other traps resolve the same way so I can't just look at that parameter. I also need to have the trigger look at "ETV-AlarmTrap-MIB::alarmTextT2 = Video Not Running" and resolve true.

To do this, I believe I'll need an item that resolves true when "ETV-AlarmTrap-MIB::alarmMajor" and "ETV-AlarmTrap-MIB::alarmTextT2 = Video Not Running" both exist in the same trap.

To reiterate: what is the syntax to have snmptrap[] detect two different parts of the same trap?

[astro_Avery]

So it looks like I've mostly figured it out, I looked up Perl-Compatible Regex and used the syntax "snmptrap[alarmMajor.*Video Not Running|Video Not Running.*alarmMajor]" and that seems to be working for the item. I'm having issues with the trigger now though, currently this trigger is working:

problem expression: {SD01:snmptrap[Video Not Running].str(alarmMajor)}=1
recovery expression: {SD01:snmptrap[Video Not Running].str(alarmNormal)}=1

However, I want to delay this trigger to only fire if the problem expression is true for 60 seconds. I've read that you can use the (min) and (max) functions for this but I don't know how to make that work with my trigger.

To reiterate: item is working, need help delaying trigger 60 seconds.

[astro_Avery]

I should clarify that I didn't end up using "snmptrap[alarmMajor.*Video Not Running|Video Not Running.*alarmMajor]", instead I simply used "snmptrap[Video Not Running]" for the item. That allows one item to catch both the problem trap and the recovery trap, then I just use the "str" function in the trigger to look for the applicable alarm state.

[astro_Avery]

I figured it out, here's my trigger solution for anyone that find this in the future:

problem expression:
{SD01:snmptrap[Video Not Running].str(alarmMajor)}=1
and
{SD01:snmptrap[Video Not Running].nodata(60)}=1

recovery expression:
{SD01:snmptrap[Video Not Running].str(alarmNormal)}=1

Since both conditions must be true, if the item "Video Not Running" has received any traps in the last 60 seconds the trigger won't fire. Note that the poller process defaults to every 30 seconds, so the trigger will fire between 60 - 90 seconds after receiving a trap that contains "Video Not Running" and "alarmMajor", but not if it receives a trap that contains "Video Not Running" and "alarmNormal" due to the recovery expression, which is exactly the behavior I'm looking for.