This is not working: Is there a special syntax to use the content of a variable an not its name?
sourcetype="test"
|stats
|eval minute=tonumber(strftime(_time,"%M"))
|eval foo=250
|eval th=if(minute > 30,"foo=100:200","foo=0:0")
|addinfo
|mycustomcommand monitor=test defaults="foo=150" thresholds=th
This working:
|mycustomcommand monitor=test defaults="foo=150" thresholds="foo=100:200"
Why is th not evaluated?
Try this:
sourcetype="test"
|stats
|eval minute=tonumber(strftime(_time,"%M"))
|eval foo="250"
|eval th=if(minute > 30,"foo=100:200","foo=0:0")
|addinfo
| map search="|mycustomcommand monitor=test defaults=\"foo=$foo$\" thresholds=\"$th$\""
Try this @spammenot66 and @HustenHelmut334.