I have an alert that logs an event and sends an email. I am trying to add the timestamp of the event to the Log Event action, but it is not being added to the log event. The timestamp is correct in the alert's search table and also being added to the Email message correctly. However, it does not show up in the Log Event.
| eval event_timestamp==strftime(_time,"%Y-%m-%dT%H:%M:%S")
| table event_timestamp
Log Event - [Event input]:
...
event_timestamp=$result.event_timestamp$
...
Send Email action - [Message input]:
...
Event Timestamp: $result.event_timestamp$
Priority: XYZ
...
I have also noticed that if I put the timestamp before other fields in the 'Log Event' action, then those fields are also missing in the log.
Any ideas why Log Event isn't working when adding a timestamp to it?
