Hi,
I need to filter the alarms in order to take different actions depending the alarms happened during the day or at night. For this, I a m trying to use the Correlation, more specifically, I want to match the alarm time with a Regex, and the only property I found that gives the Alarm Time is Property: Alarm.Time, however, I don't know in which format this expression returns, so I am unable to match it with a Regex.
Also, I would like to know how I can get the format of the return of all the other properties.
Thank you.
Maybe also good to mention here that "Property: Alarm.Time" here refers to a custom property named "Time" on alarm events. This is not a standard/default property on alarm events and is not to be confused with the "Time" value as listed on the "details" part of an alarm card.
What the value of that custom "Time" property on alarm event is and how it is formatted will depend on how it was set up and is being used on this specific cluster. For example, it might not be filled out for all alarm events.
As an alternative, would it be an option to have a correlation rule which is unaware of it being day or night, and have an automation script as action in which you could then check the time of day and decide on actions to take?