As an example I get an alarm in the event log that has something like:
ALERT: ##.##.##.##/24 scope or subnet has fewer IPs...
But when I look at the suppression key it actual says that variable $scope is listed as scope
Product: UIM
Component: ntevl
Column chosen in the variable is incorrect.
In the above case as an example, we had column 3 chosen which was the wrong position. The variable was working but, in this case, it was misleading as the variable name was the same as the 3rd column or word in the message. Column should be seen as synonymous with word, so the column 3 would be the third word in the message text of the event viewer message. In this case we should actually set the variable to 2. Example:
as the second word (column) in the message text is the scope ##.##.##.##/24.