I am using a search macro in an eval and it returns all zeros. But, when I expand it, it functions as expected. Is that normal?
ie:
`get_all_email` | stats count(eval(`receive_event`)) as Sent by recipientlist
This returns all zeros.
`get_all_email` | stats count(eval(((event_id="DELIVER" AND source_id="STOREDRIVER") OR (event_id=1023)))) as Sent by recipientlist
This works perfectly.
Interesting. I think there was something wrong with the macros.conf file. I opened it to paste the contents, and it looked like this:
[receive_event]
definition = ( (event_id="DELIVER" AND source_id="STOREDRIVER") OR\
(event_id=1023) )\
iseval = 0
My other eval/macro was working that looked like this:
[send_event]
definition = ( (event_id="TRANSFER" AND source_id="ROUTING") OR (event_id=1033) )
iseval = 0
So, I modified the receive_event manually to look like this:
[receive_event]
definition = ( (event_id="DELIVER" AND source_id="STOREDRIVER") OR (event_id=1023) )
iseval = 0
And now it seems to be working.
Interesting. I think there was something wrong with the macros.conf file. I opened it to paste the contents, and it looked like this:
[receive_event]
definition = ( (event_id="DELIVER" AND source_id="STOREDRIVER") OR\
(event_id=1023) )\
iseval = 0
My other eval/macro was working that looked like this:
[send_event]
definition = ( (event_id="TRANSFER" AND source_id="ROUTING") OR (event_id=1033) )
iseval = 0
So, I modified the receive_event manually to look like this:
[receive_event]
definition = ( (event_id="DELIVER" AND source_id="STOREDRIVER") OR (event_id=1023) )
iseval = 0
And now it seems to be working.
that looks like a bug in the UI putting linebreaks into the macro.
it would be helpful to see your macro definition/macros.conf file.