Hello All,
I have a simple search for the alert:
Index="vpn" message="recently failed"
|table _time, host,message
Alert triggers when results are >2
I need to put all events field's results in the ServiceNow ticket description.
Unfortunately, $results.fieldname$ take results of the first event.
But this alert requires to have >2 events.
Are there any options to manage it with multiple events?
Thank you in advance!
