Hi,
In the alert overview, the timestamp for non-aggregated events is the time of the message itself, without any information when the rule was evaluated.
This makes it hard to track / understand the cause of an alert.
Is it possible to include the evaluation time, perhaps as additional field?
Kind regards
PRE