Brian Tillman schrieb:

One rule will do that, given the conditions above. Resend all messages with
"test warning" OR "test alarm" to .
--

In this case I have different other signs between the word "test" and
the other two words I am looking for (alarm or warning).
A string would read like this:
test 11. Aug. 2006, 10:56 - Alarm
or
test 10:56, xxc - Warning

thats why I am looking for a logical "AND"

any more hints?

regards from sunny Vienna/Austria
Julius