Trying syslog to alarm in HP iMC, problem with Template Content

[ryccsalud]

Hello,

I have a syslog template created from this syslog trap:

<15> Dec 4 11:10:40 192.168.194.82 1X : 1X m8021xCtrl:Port 3: Received Auth Failure for client 5cff35-00512f, finished authentication session for RyC.

I created the syslog tempate with this Template Content:

<*> *:*:* $(DeviceIP) 1X  : 1X   m8021xCtrl:Port $(DevicePort): Received Auth Failure for client $(UserMAC), finished authentication session for $(UserName).

If I create a syslog to alarm, it rules correctly, but, if I show the "DeviceIP" param, I get the Ip address with date's seconds at left:

40 192.168.194.82.

40=seconds from original date  (Dec 4 11:10:40)

192.168.194.82 = Ip address

How should I write the "Template Content" creating my syslog template to show only the IP?

I have tried *, %, ??, etc, but I can't show it without date's seconds.

Thans.

[ibias]

I'm not sure but could be that the "SourceIP" is better then "DeviceIP". Check the content of the syslog and try again.