stats. eval and search macros?

[jgauthier]

I am using a search macro in an eval and it returns all zeros. But, when I expand it, it functions as expected. Is that normal?

ie:

 `get_all_email` | stats count(eval(`receive_event`)) as Sent by recipientlist

This returns all zeros.

`get_all_email` | stats count(eval(((event_id="DELIVER" AND source_id="STOREDRIVER") OR (event_id=1023)))) as Sent by recipientlist

This works perfectly.

[jgauthier · Accepted solution]

Interesting. I think there was something wrong with the macros.conf file. I opened it to paste the contents, and it looked like this:

[receive_event]
definition = ( (event_id="DELIVER" AND source_id="STOREDRIVER") OR\
(event_id=1023) )\

iseval = 0

My other eval/macro was working that looked like this:

[send_event]
definition = ( (event_id="TRANSFER" AND source_id="ROUTING") OR (event_id=1033) )
iseval = 0

So, I modified the receive_event manually to look like this:

[receive_event]
definition = ( (event_id="DELIVER" AND source_id="STOREDRIVER") OR (event_id=1023) )
iseval = 0

And now it seems to be working.

[gkanapathy]

that looks like a bug in the UI putting linebreaks into the macro.

[gkanapathy]

it would be helpful to see your macro definition/macros.conf file.