Why does a one word message_subject disappear in my search? Crazy behavior

[nick405060]

Why do two word message_subjects (e.g. "hi tom") or a message_subject with a single quotation mark after it (e.g. "hi\"") table the result properly, while a message_subject with a single word (e.g. "hi") not table? :

| makeresults | eval message_subject="hi" | map maxsearches=10000 search="| makeresults | eval message_subject=$message_subject$" | table message_subject

[nick405060 · Accepted solution]

Solution is to put quotes around $message_subject$ in the mapped search. No idea why.

 | makeresults | eval message_subject="hi" | map maxsearches=10000 search="| makeresults | eval message_subject=\"$message_subject$\"" | table message_subject