I have an item to look at an windows event log. To parse the output I have made two dependet items with reg exp preprocessing. These values I want to use in the trigger name.
Triggername: Neuer Benutzer {ITEM.LASTVALUE1} angelegt durch {ITEM.LASTVALUE2}
Triggerexpression: {Windows Event Log - Usermanagement:event.usermanagement.accountname.st r(NULL)}=1
or {Windows Event Log - Usermanagement:event.usermanagement.requestorname. str(NULL)}=1
or {Windows Event Log - Usermanagement:eventlog[Security,,,,^(4720|4726)$,,].logeventid(4720)}=1
problem 1: it triggers two or three times at once, after one event.
problem 2: it shows not the lastvalue, of the actual data, instead the last historic data in item.lastvalue1/2.
Any ideas?
See screenhots. I only have added user test13 and test14. But he also displays test12 (that was already added and triggered)


Triggername: Neuer Benutzer {ITEM.LASTVALUE1} angelegt durch {ITEM.LASTVALUE2}
Triggerexpression: {Windows Event Log - Usermanagement:event.usermanagement.accountname.st r(NULL)}=1
or {Windows Event Log - Usermanagement:event.usermanagement.requestorname. str(NULL)}=1
or {Windows Event Log - Usermanagement:eventlog[Security,,,,^(4720|4726)$,,].logeventid(4720)}=1
problem 1: it triggers two or three times at once, after one event.
problem 2: it shows not the lastvalue, of the actual data, instead the last historic data in item.lastvalue1/2.
Any ideas?
See screenhots. I only have added user test13 and test14. But he also displays test12 (that was already added and triggered)
Comment