What am I doing wrong with the aggregate macro syntax in my correlation search to create notable events?

[DF10569]

Search I am trying to use:

index="wineventlog" (EventCode=4656 Accesses=DELETE) OR EventCode=1102 OR EventCode=4670 OR EventCode=564  |  `get_date(now())` | `aggregate("Endpoint - FIM - Rule".date.Object_Name)` |  eval _time=now() | eval orig_raw=_raw | fields - _raw

If I leave in the macro

`aggregate("Endpoint - FIM - Rule".date.Object_Name)` 

I receive an error stating aggregate(1), which I haven't been able to find any information on what my syntax issue is.

If I take out the aggregate macro, the search will bring back results.

Two items that i need help with:

1. What am I doing wrong with the aggregate macro syntax?
2. Even though the search brings back results, notable events are not created.

Thank you!

[sundareshr]

Try changing the double quotes around your fieldname to single quotes.... 'Endpoint - FIM - Rule' .Or try defining a variable and passing that variable to the macro. | eval agg_input='Endpoint - FIM - Rule'.date.Object_Name | aggregate(agg_input) Not sure if either will work, but worth a try.

[DF10569]

Thank you for you help, but I tried both options and still received the same error.