Can not find macros.past_$m this while setting rules

macros.past_$m how do i add/enable this macro?

can some one help?
is this a bug or what?

Hi Gazzin_Test

Did you get anywhere with this?

Im having the same issue,


They are.

I think they just are not able to be selected for the value to compare with, only the one to search for.

I mean, you are looking for something like this:

syslog.timestamp >= `macros.past_5m`

And never for something like

`macros.past_5m` OPERATOR whatever

Thanks, so something like this should work then?

no, that checks if syslog.timestamp is equal to the literal string “macros.past_5m”…

You need syslog.timestamp >= `macros.past_5m`

put backticks for the macros.past_5m

1 Like

So like this?

Thank for your support btw TheGreatDoc and murrant still a noob at this stuff haha

Change the equal in the syslog.timestamp for greater or equal

So like this?

Yes, that should work

Cheers TheGreatDoc, that appears to work for one of the devices I have tested,