Like to know what kind of udata fields are common on all alarm message ?Why some enrichment rules match_alarm_field need to use value udata.source and some just the value robot then will work ?
Dear GuanHua1378
can you add a bit more context around your question? It seems that you are trying to solve a use case surrounding alarm_enrichment, and more details would help. What exactly are you trying to achieve?
Kind Regards,
Martin Fink
CA Tech Support