Edit your current trap definition and at the bottom add this to the Additional Raw Data input:
Code: Select all
MATCH $2: !(Alarm cleared)Code: Select all
MATCH $2: (Alarm cleared)See if those work for you, the first one will match only if "Alarm cleared" doesn't exist in that SNMP enterprise variable, the second one only matches if it does contain it.