How can I make a condition to look for differences in time

[karl2k1]

I have a rule that is meant to fire when an AD account is locked out.  Sometimes our events show a gap in time between end time and manager receipt time, anywhere from 5 minutes to several hours.  Not quite sure why this occurs to begin with.

I'd like to have a condition similar to the following, but having issues:

NOT Manager Receipt Time > End Time + 5m

I can make a time difference variable, but I am not allowed to use the > operator

[chenselein1]

Hi Karl,

you are right on: Use a TimeDifference Variable - why are you not allowed to use <> here?

[karl2k1]

I thought it would be that simple, but I only get the following options for a variable:
=
!=
In
Contains
StartsWith
EndsWith
Like
Is

I do not get the option of >,<, >=, or <=.  Its almost like it thinks of the variable as a string instead of an integer

[sorinodc]

Karl,

You have to use a local variable (as Cristoph mentioned) that automatically calculates the time difference for you. Please see below how you can easily do that.

Good luck!

[karl2k1]

followed those exact steps, still no option for those boolean expressions

[karl2k1]

Any ideas?  I'll ask HP, most likely they will refer me to HP professional services

[douglas.baker@h1]

All of the examples are right. When you want to include the 'Local Variable' in the Active Channel as a Filter then during the Filter selection process the Conditions of "=", "!=", "<",.... are exposed for your selection. Choose one, e.g. 'timedifference > 60.0' would show those events where your 'time difference in seconds Local Variable' was more that 60.0 seconds.

Tune from there.

Thank you,

Doug

[karl2k1]

Thanks for the reply doug, the problem is that those expressions are not available from the drop down, as indicated by my screenshot on the 26th.  I created a ticket with HP, we'll see what happens

[karl2k1]

This is the response I got on 5/3 from HP support:

I tested the scenario in my test system and created a timedifference variable to show time difference between ET and MRT. I was able to reproduce the issue and I also could not see >,<, >=, or <= options. I got those options for all other variables except the timedifference variable. I will have to check if this is a bug or if it is something else. I will update you very soon. Thanks!

Regards,

Srujana

[chenselein1]

This is quite interesting. I have been working with this variable and >< in many Cases and it always worked - on what ESM Version are you Karl?

[karl2k1]

This is the Express 3 with CORR, using the 5.1.0.1281.3 console

[sorinodc]

I was also testing it on the Express 3 CORR, but I don`t remember exact version of the console.

Do let us know once you have any updates from HP Support.