Your only option is to use eval, but there is a neat trick we can use to make it a little less painful.
[format_kb_human(1)]
args = field
definition = `format_kb_human($field$,"fieldformat")`
iseval = 0
[format_kb_human(2)]
args = field, command
definition = `command` $field$=tostring(case(abs($field$)>=1000000, round($field$/1024/1024,2), abs($field$)>=1000, round($field$/1024,1), NOT isnull($field$), round($field$,1), 0==0, "")) . case(abs($field$)>=1000000,"G", abs($field$)>=1000,"M", NOT isnull($field$), "K", 0==0, "")
iseval = 0
Then you can replace it in your alert search string with the 2nd parameter being "eval".
... View more