Help with Poorly Written Trigger

[beturnbough]

Whenever I tie a specific template to a host, i always get a 'problem' alert.

The trigger is like this:

{Facet - Windows - Service - Symantec Endpoint Cloud Service - Active:service.info[Symantec Endpoint Protection Cloud].min(15m)}>0

How can I tune this trigger so it doesn't complain until some data has been collected and evaluated?

Thanks,

Brad

[beturnbough]

Can anyone offer some advice?

Thank you!

Brad

[beturnbough]

I only want the trigger to fire if 15 minutes or more of data has been collected.

For example:

8:00am --- data collected, value 0
8:05am -- data collected, value 1
8:10am --- data collected, value 1
8:15am --- data collected, value 1 --- enough data has been collected at this point, fire trigger if logic states to do so.

I've tried " nodata(15m) = 0 and max (15m)<'1' " ...... I still get an email once the first value is collected (it's 0... less than 1)

Thoughts?