Splunk Apps » Insteon

It looks like the problem is that the "get_all_link_group_annotation" macro doesn't work correctly when the to_device is empty.

Repro search:

`get_all_link_group_annotation(13, 0, 19.8e.06, )`

The report search is:

| stats count | eval command="13" | eval command=if(substr(command,1,1)=="0", substr(command,2,1), command) | eval all_link_group="0" | eval from_device="19.8e.06" | eval to_device="" | lookup all_link_annotations command all_link_group from_device to_device OUTPUTNEW annotation | fields command all_link_group from_device to_device annotation

Removing the lookup on to_device makes this work.

I'm not sure why this search succeeds:

sourcetype=insteon_plm from="19.8e.06" `get_command_info`   `lookup_all_link_group_annotation(command,from,to)`   `lookup_all_link_group_annotation(command,from)`| table _time status from to command options           | sort -_time

This does work:

| stats count | eval to="" | eval from="19.8e.06" | eval all_link_group="0" | eval cmd1=11  `lookup_all_link_group_annotation(command,from,to)`   `lookup_all_link_group_annotation(command,from)`| table _time status from to command options