Can not find macros.past_$m this while setting rules

[Gazzin_Test]

macros.past_$m how do i add/enable this macro?

[Gazzin_Test]

can some one help?
is this a bug or what?

[AJJ]

Hi Gazzin_Test

Did you get anywhere with this?

Im having the same issue,

Cheers

[TheGreatDoc]

They are.

I think they just are not able to be selected for the value to compare with, only the one to search for.

I mean, you are looking for something like this:

syslog.timestamp >= `macros.past_5m`

And never for something like

`macros.past_5m` OPERATOR whatever

[AJJ]

Thanks, so something like this should work then?

[murrant]

no, that checks if syslog.timestamp is equal to the literal string “macros.past_5m”…

You need syslog.timestamp >= `macros.past_5m`

[TheGreatDoc]

put backticks for the macros.past_5m

[AJJ]

So like this?

Thank for your support btw TheGreatDoc and murrant still a noob at this stuff haha

[TheGreatDoc]

Change the equal in the syslog.timestamp for greater or equal

[AJJ]

So like this?

[TheGreatDoc]

Yes, that should work

[AJJ]

Cheers TheGreatDoc, that appears to work for one of the devices I have tested,