Sitescope Alert Template (CEF): extract "content match" from <<state>>

[ThomasLanz]

Hello experts

Is there a way to extract "content match" of web service monitor to fill in a event field (common event format)?
In <<state>> property is always the round trip time, which is different from every run.

Use case:
We are using a "Web Service Monitor" to check whether an email is the in inbox of a specific user (exchange web service).
Using the content match we extract the last mail-id. Now in the alert we would like to use the content match value in a key-field for the bsm event.
The problem is that only <<state>> property can be used in common event format and this contains always a roundtrip time.
Using <<all>> property we can see that the content match is saved to a variable but we can not assign it in a event.

Please help!

Thank you very much in advance!

Kind regards,
Thomas

[Dmitry Shevchenko · Accepted solution]

Did you try to use <<matchValue>> ?

[ThomasLanz]

perfect!<<matchValue>> does the job!