Hello!
I have a information trigger severity with the following expression:
Problem: {DC01:eventlog[Security,,,,4740].logeventid(4740)}=1
Recovery: {DC01:eventlog[Security,,,,4740].nodata(5)}=0
How can I change the recovery expression to close the incident after 3 hours past?
Thank you.
I have a information trigger severity with the following expression:
Problem: {DC01:eventlog[Security,,,,4740].logeventid(4740)}=1
Recovery: {DC01:eventlog[Security,,,,4740].nodata(5)}=0
How can I change the recovery expression to close the incident after 3 hours past?
Thank you.