I have LV successfully creating alert rules and alerts emailing or adding them to last 25 events.
My issue is that I'd like a meaningful filtered message. I've used both of these:
${N=SWQL;M=SELECT SUBSTRING('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}',
CHARINDEX('mtrapinfoString = ','${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}')+18,
( CHARINDEX(' : ','${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}') - CHARINDEX('sysUptTime =' ,'${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}') -13
)
) AS Message
FROM Orion.Nodes n}
and also
${N=OLM.AlertingMacros;M=OLMAlertMessage.VbData4}
The result is that all i get in an email or in last 25 is the exact query above(see below).
I know this is some stupidity on my part, but I'm stumped.
