Advanced settings
The options available in Advanced settings depend on the trigger type and alert type selected.
Select alert timestamp
Note
Timestamp selection is only available for Aggregate alerts and Scheduled searches.
Options are: (when the event entered LogScale), or (when the event actually happened in the producing system). For general information about timestamps for triggers, see Timestamps for triggers.
The timestamp selection is reflected in Properties panel and can be changed at any time from there. The alert timestamp selection is reflected in the footer of the Time Interval panel, see Change Time Interval for more details.
The selected timestamp appears as a new column in the Event List, identified by a tiny time icon: the column will show the time frame the page is actually running on, driven by the chosen timestamp:
 |
Figure 209. Timestamp Selection in Event List
Query ownership
Use this section to set the owner of the query. Note that you might not see all available options if you do not have the necessary permissions. For general information about the query ownership, see Query ownership.
Select Run on behalf of organization to have ownership belong to an organization. You can see and edit this field if you have
Change persistent queries to run on behalf of organizationorrootsystem permissions. See also Organization Owned QueriesSelect Run on behalf of user to run the trigger on behalf of another user that is, using their permissions; click this field to get a list of available users, or directly enter the name of the user to run the trigger as. You can see and edit this field if you have the
ChangeTriggersToRunAsOtherUserspermission.