How to use Alert Variable Format resulting Value?

You can wrap that macro in other macros if you want to snip stuff from it, see string functions on here: github.com/.../SWQL-Functions

You can also use varbind macros to pull specifics out, i think it's like ${VARBIND1} etc

Thanks Adam, I'm not entirely sure, no, I'm sure I'm not sure how to do either of those. I'm still struggling with Downsample on the other thread as part of a custom alert where the select line seems uneditable.

Got some sanitized example text you want to pull out of some other sanitized example text?
Usually i'd jump in SWQl studio but i'm without it for a few days at the mo

This is coming from Log Analyzer from a VMware event to the variable mentioned above.
"Virtual machine ELDSWAPE01TST was migrated from host cltesxprd003.mydomain.local, CLT_PROD_DS_4TB_04 in XXXX-CLT to cltesxprd005.mydomain.local, CLT_PROD_DS_4TB_04 in MUSA-CLT"

I want to pull ELDSWAPE01TST from it

I'm going to ignore the varbinds method for the moment because I cant refer to it

Make a custom SWQL Macro, something like


SELECT TOP 1 

SUBSTRING('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}', 15, CHARINDEX(' ', '${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}',15)-15 )

FROM Orion.nodes N

Freehanded that, please test lol

Will do, and when you say create a SWQL macro are you taking about this?
Custom macros (variables) in NCM (solarwinds.com)

No, when you're in an alerting trigger action or similar, on the variable picker there's a checkbox for custom swql/sql

You can do most stuff with that (albeit with difficulty)

You may want to look at this feature as well - Define SQL/SWQL Variable

jameslindsay  thats the checkbox i was referring to in our chain, thanks bob