OperationalData shows latest log[] value instead of the trap that triggered the event

[Tejasree]

I’m using a single log item (log[C:\Zabbix\logs\snmptrapd.log,DISMAN-EXPRESSION-MIB,,,skip]) to ingest all SNMP traps.
Triggers fire correctly for each OID, but Operational Data always shows the latest trap, not the one that originally created the event.
Since every new trap updates the log item’s value, older problems end up displaying unrelated trap data.
For example:
10:00 - databaseDown trap arrives → Problem A is created.
10:05 - serviceDown trap arrives → Problem B is created.
10:10 - databaseUp trap arrives.
After the third trap arrives, the Operational Data shown for Problem A is updated to display information from the databaseUp trap instead of the original databaseDown trap that created the event.

I tried {ITEM.VALUE} doesn’t help—it still shows the current log value and only a shortened preview, not the original trap.

[cyber]

Resolution to shortened (to 20 characters) value is in docs..

https://www.zabbix.com/documentation/7.0/en/manual/appendix/macros/supported_by_location#items

To resolve to a full value, you may use macro functions, as no values are truncated by the server. For example: {{ITEM.VALUE}.regsub("(.*)", \1)}

and operational data is "operational" ie.. "right now"... not historical..

Operational data

Enter some string with macros to display dynamic, real-time data in Monitoring > Problems. Alternatively, leave this field empty to display the latest values of all items from the trigger expression. The same set of macros is supported as in the trigger name, with the ability to resolve dynamically. For example: {ITEM.VALUE<1-9>} resolves to the item values at the moment the trigger state is changed (problem created, resolved, closed manually, or closed by correlation). {ITEM.LASTVALUE<1-9>} resolves to the latest item values.

Your item value is "DB up" at the moment of trigger resolve, so your operational value will also be "DB up", not "DB down"...