@mike1098 I think thos are the “available” macros:
Raw context:
CONTACTEMAIL=
CONTACTNAME=
CONTACTPAGER=
DATE=
HOSTACKAUTHOR=
HOSTACKCOMMENT=
HOSTADDRESS=
HOSTALIAS=
HOSTATTEMPT=
HOSTCHECKCOMMAND=
HOSTDOWNTIME=
HOSTGROUPNAMES=
HOSTNAME=
HOSTNOTIFICATIONNUMBER=
HOSTOUTPUT=
HOSTPERFDATA=
HOSTPROBLEMID=
HOSTSTATE=
HOSTSTATEID=
HOSTTAGS=
HOST_ADDRESS_4=
HOST_ADDRESS_6=
HOST_ADDRESS_FAMILY=
LASTHOSTSTATE=
LASTHOSTSTATECHANGE=
LASTHOSTSTATEID=
LASTHOSTUP=
LASTSERVICEOK=
LASTSERVICESTATE=
LASTSERVICESTATECHANGE=
LASTSERVICESTATEID=
LONGDATETIME=
LONGHOSTOUTPUT=
LONGSERVICEOUTPUT=
NOTIFICATIONAUTHOR=
NOTIFICATIONAUTHORALIAS=
NOTIFICATIONAUTHORNAME=
NOTIFICATIONCOMMENT=
NOTIFICATIONTYPE=
SERVICEACKAUTHOR=
SERVICEACKCOMMENT=
SERVICEATTEMPT=
SERVICECHECKCOMMAND=
SERVICEDESC=
SERVICEGROUPNAMES=
SERVICENOTIFICATIONNUMBER=
SERVICEOUTPUT=
SERVICEPERFDATA=
SERVICEPROBLEMID=
SERVICESTATE=
SERVICESTATEID=
SHORTDATETIME=
Computed variables:
CONTACTS=
HOSTFORURL=
HOSTOUTPUT_HTML=
HOSTSHORTSTATE=
HOSTURL=
LASTHOSTSHORTSTATE=
LASTHOSTSTATECHANGE_REL=
LASTHOSTUP_REL=
LASTSERVICEOK_REL=
LASTSERVICESHORTSTATE=
LASTSERVICESTATECHANGE_REL=
LONGSERVICEOUTPUT_HTML=
MICROTIME=
MONITORING_HOST=
OMD_ROOT=
OMD_SITE=
PREVIOUSHOSTHARDSHORTSTATE=
PREVIOUSHOSTHARDSTATE=
PREVIOUSSERVICEHARDSHORTSTATE=
PREVIOUSSERVICEHARDSTATE=
SERVICEFORURL=
SERVICEOUTPUT_HTML=
SERVICESHORTSTATE=
SERVICEURL=
WHAT=