Doug- Thanks for the / vs \ correction.

When I tested:
rec.woodworking Flag:X-POST3+ xref:[^:]+{3,}
I found it flags 4 or more xposted groups.
Likewise,
rec.woodworking Flag:X-POST2 xref:[^:]+{2,}
flags 3 or more xposted groups.

In trying to flag 2+ groups the obvious
rec.woodworking Flag:X-POST2 xref:[^:]+{1,}
also flagged 3 or more xposted groups.

How would your expression be modified to select for
2+ groups?

When testing I created a second account for newsgroups
and subscribed and unsubscribed to the wreck as many
times as needed to test my different settings. This way I
could use the real troll posts instead of running test posts
everywhere. I also changed all Drops to Flags so I could
see if the hits were on target vs false positives.

Art




"Doug Miller" wrote in message
y.com...

rec.woodworking Drop xref:.*rec/.pets.*

Should be a backslash \ instead of forward slash /

#Drop x-posted to 3+ groups
rec.woodworking Drop xref:[^:]*:[^:]*:[^:]*:.*

xref:[^:]+{3,}

#Drop x-posted to 2+ groups
#rec.woodworking Drop xref:[^:]*:[^:]*:.*

xref:[^:]+{2,}


--
Regards,
Doug Miller (alphageek-at-milmac-dot-com)