Would doing it with SQL be acceptable?
I have this SQL query that I use to report on reoccurring alarms. I believe it would suit your needs as well if you modify the grouping and where clause, and make it select from NAS_ALARMS
select
count(*) as 'count', origin, robot, prid, hostname
from
NAS_TRANSACTION_SUMMARY
where
created > dateadd(day, -7, convert(date, getdate()))
group by
origin, robot, prid, hostname
having
COUNT(*) > 20
order by
COUNT(*) desc
Here's the basic syntax for querying nis db from nas:
rc = database.open("provider=nis;database=nis;driver=none")
query = "select * from nas_alarms where origin = '***'"
alarms, rc = database.query(query)
for _, al in pairs (alarms) do
print (al.nimid)
end
database.close()
-jon