2 Replies Latest reply on Jan 29, 2015 5:43 PM by protah

    Changing alarm type from "internal event match" to "Field Match"


      Current Version:   9.4.1  Build 20140924093413


      I am attempting to change my alarms from an Internal Event Match to a Field Match.  This was suggested, as it will put the load on the receiver instead of the ESM.


      The Internal Event Match uses:

      Field: Signature ID

      Value: 277-1033982


      The Filed match I used:

      Match component: Filter -> Signature ID (In)  [277-1033982]


      I did force the alarm sync.


      My original alarm will trigger everytime, but the field match will not trigger.  Any suggestions?