How can I make a condition to look for differences in time
I have a rule that is meant to fire when an AD account is locked out. Sometimes our events show a gap in time between end time and manager receipt time, anywhere from 5 minutes to several hours. Not quite sure why this occurs to begin with.
I'd like to have a condition similar to the following, but having issues:
NOT Manager Receipt Time > End Time + 5m
I can make a time difference variable, but I am not allowed to use the > operator
I thought it would be that simple, but I only get the following options for a variable:
I do not get the option of >,<, >=, or <=. Its almost like it thinks of the variable as a string instead of an integer
You have to use a local variable (as Cristoph mentioned) that automatically calculates the time difference for you. Please see below how you can easily do that.
All of the examples are right. When you want to include the 'Local Variable' in the Active Channel as a Filter then during the Filter selection process the Conditions of "=", "!=", "<",.... are exposed for your selection. Choose one, e.g. 'timedifference > 60.0' would show those events where your 'time difference in seconds Local Variable' was more that 60.0 seconds.
Tune from there.
Thanks for the reply doug, the problem is that those expressions are not available from the drop down, as indicated by my screenshot on the 26th. I created a ticket with HP, we'll see what happens
This is the response I got on 5/3 from HP support:
I tested the scenario in my test system and created a timedifference variable to show time difference between ET and MRT. I was able to reproduce the issue and I also could not see >,<, >=, or <= options. I got those options for all other variables except the timedifference variable. I will have to check if this is a bug or if it is something else. I will update you very soon. Thanks!