Hello Team,

In trigger configuration form the trigger expression as well as recovery expression fields accept {TRIGGER.VALUE} macro as item filter/key within aggregate functions syntax. Please see example below:

max({TRIGGER.VALUE},15m)=1

{TRIGGER.VALUE} represents current trigger state as numeric value, so there is nothing to be aggregated. This may cause triggers to incorrectly fire an alert or not being resolved at all.