SSIM cannot use on reports Original Event Date
I describe the situation. Customer has SSIM 4.7 and SEP 12.1 with SQL server. Sometimes happend that collector hung. If i solve the probem. Collector send cached events to SSIM.
All reports on SSIM which are possible for using with SEP product use on all reports value from EventDate.
If customer has every day cca 0-10 virus incidents and collector hungs, after 2 weeks if collector send evetns again to SSIM the reports cannot show that virus incidents was 0-10 per day. Report use, that 13 days was no virus incident, and 14 days (day of repairing collector) show all virus incidents on same date. Why?
Every Virus incidents has many values such as virus name, computer name and there are also values EventDate, and Original Event date.
I need used for reports not value EventDate, but OriginalEventDate...
Any solution? Thanx Vladimir