Capture Repeated Actions with Recurring
Recurring captures repeated occurrences of a selected event while zinzu collects the other required events.
Without Recurring, additional records for an already-matched event are normally ignored. With Recurring, those repetitions become part of the matched set, up to the maximum you specify.
Example: Failed Logins and a Security Review
Find sessions containing both Login Failed and Security Review Created, while capturing up to three failed-login records in the matched set.
A security review may be created before or after a failed login, so either order is allowed.
EventOwner: Session ID Event basket: Login Failed + Security Review Created System filter: Recurring on Login Failed, maximum count 3
Build the Query
- Add Login Failed and Security Review Created to the event basket.
- Add Recurring to the system filter basket.
- Select Login Failed under Event to recur.
- Set Maximum recurrence count to 3.
- Click Apply filter.
How It Works
A maximum count of 3 allows one, two, or three Login Failed records in total, including the first occurrence.
| Activity for the same session | Result |
|---|---|
| Login Failed → Security Review Created | Completes with one failed login |
| Login Failed → Login Failed → Security Review Created | Completes with two failed logins |
| Three Login Failed records → Security Review Created | Completes with three failed logins |
| Security Review Created → Login Failed | Completes; either order is allowed |
| Four Login Failed records before Security Review Created | The fourth failure exceeds the maximum; the current candidate fails and a new candidate starts |
In the last example, the fourth Login Failed record starts the new candidate. A subsequent Security Review Created record can complete that new set.
The maximum does not require exactly three occurrences. Login Failed is required because it is in the event basket; Recurring allows additional occurrences up to the configured total.
When Does Counting Stop?
Counting stops when all required events have matched and the configured filters pass.
For example:
Security Review Created → Login Failed
This set completes on the first Login Failed record. Later failed logins are outside that completed set.
The maximum applies to the set being collected. It does not limit the total number of failed logins across the session’s entire queried history.
When to Use It
- Capture repeated failed logins alongside a security review.
- Capture repeated payment attempts alongside other required processing actions.
- Capture repeated alerts alongside other required operational events.
Important Notes
- Maximum recurrence count includes the first occurrence. A value of 3 means up to three matching records total.
- The available maximum-count setting is 1 to 50.
- Only one Recurring filter can be added.
- Recurring does not impose an order on the required events.
- To require multiple occurrences, add separate copies of the event to the basket.
- If identical copies are also present, records matching those copies contribute to the selected event definition’s recurring count.
- Exceeding the maximum fails the current candidate, not every possible set for that EventOwner.
- When combining filters, use AND if the recurring maximum must pass along with every other filter. With OR, another passing filter can qualify the set.
- The sequence record limit still applies independently.