VMware failed logins triggers

[Mangirdas]

Hello,

I am trying to configure triggers fo failed logins and also for "good" logins, but the problem with triggers are that I can't get right value from Item, expression is simple:

{vcenter:vmware.eventlog[{$VMWARE.URL},skip].regexp(Failed)}=1

but usually I am not getting values with Failed keyword. Any advice?

[Mangirdas]

Yes, the latest data is showing matches, but it seems that trigger is activating when is necessary, but alert comes in email with wrong data

[cyber]

Is your "Latest data" showing any possible matches? As long as I understand, this item pulls all of the log, so if something like that is in original data, your trigger should work.
Is there any preprocessing applied to item?