Why do two word message_subjects (e.g. "hi tom") or a message_subject with a single quotation mark after it (e.g. "hi\"") table the result properly, while a message_subject with a single word (e.g. "hi") not table? :
| makeresults | eval message_subject="hi" | map maxsearches=10000 search="| makeresults | eval message_subject=$message_subject$" | table message_subject
Solution is to put quotes around $message_subject$ in the mapped search. No idea why.
| makeresults | eval message_subject="hi" | map maxsearches=10000 search="| makeresults | eval message_subject=\"$message_subject$\"" | table message_subject
Solution is to put quotes around $message_subject$ in the mapped search. No idea why.
| makeresults | eval message_subject="hi" | map maxsearches=10000 search="| makeresults | eval message_subject=\"$message_subject$\"" | table message_subject