How can I carry over the created date from one active list to another?
I have "online list" that has all of our machines we watch. the count is updated whenever there is activity from the machine that meets the conditions within a rule. it is updated as a target hostname. If a machine has no activity for 48 hours, it will expire off of the list because the list has a TTL of 2 days. it
When it expires from the list, I have it drop into an "offline list" by using the internal event that turns the target hostname to device custom string4. It does not carry over the original created date from the online list
I think i have to do something in the action tab of the rule that looks for expired that does set field xxx = $fileCreateTime ?
i've never worked with field actions or variables in arcsight before, but this seems like something very simple. thanks!