Hi,
I'm configuring the action rule when an alert is raised on ITSI and I'd need to add the time in the message or the subject of the email sent.
I've seen the following fields:
$result.start_time$
$result.last_time$
but the time appears in epoch, something like this: 1607006402.725
I've seen that on the $result.orig_raw$ field the beginning is the time when the event start, but there is so much information after. (Example: "result.orig_raw=12-04-2020 09:30:02 KPI alert..."
Would it be possible to extract the time in a format like "dd-mm-yyyy hh:mm:ss" with a different field? If not, could I extract from the orig_raw the beginning of the text? Or transform any of the start_time or last_time values to that format?
Cheers!
