Thanks for the answer. I just tried it too, without success.
I was thinking that can exist some "udata.value" for probe that is not properly "probe", you know?
In alarm_enrichment log (level 4), I can see something like "prid=>probename"
------------------------------------------------------------------------------------------------------------------
PDS[udata=>[PDS[subsys=>XX, level=>0, source=>10.X.X.X, message=>Alarm "" on switch "XXXXX". Maint Object="_PE". On board="1". Port="A:\"PE Health Check device is responding\"", Error Code="" (Alarm number="FPA:00000:0000000000:0821170220::N". Product ID="1000000000". IPAddress="10.X.X.X". Category=""), ]]pri=>0, subject=>alarm, origin=>XXXX, hop=>1, prid=>snmptd, source=>172.X.X.X, nimts=>1503416252, dev_id=>D8AC73A8D313C0631522A6A3517EFD301, robot=>robot02, nimid=>PO84063187-76632, supp_key=>snmptd/X.X.X.X"_PE", tz_offset=>10800, hop0=>HUB, domain=>XXXX, suppression=>y+000000000#snmptd/X.X.X.X"_PE", hop1=>HUB, met_id=>MCA617AEE7985D826F622427D266B0D31, ]
------------------------------------------------------------------------------------------------------------------
I tried "./nimalarm -S <source> "<message>" -v prid=logmon" and also "./nimalarm -S <source> "<message>" -v prid=>logmon"