Alert Variable for to portray the Down Time from the Event Logs or the real time the device became unreachable instead the AlertTriggerTime

alonajean

Would like to ask the exact Variable to have the downtime of the device instead of the AlertTrigger Time. 

The data is like this,

TRIGGER CONDITIONS: Node STATUS is equal to DOWN

Condition must exist for more than 10 minutes

TRIGGER ACTIONS: To create a ServiceNow Incident

Then date and time seen in the ServiceNow is the time when the alert has been triggered, which is 10 minutes after the real down time of the device

${N=Alerting;M=AlertTriggerTime;F=DateTime} <-- Variable seen on the list

Output needed is the real downtime, which is seen in the Events