Problem with count with last function as data

[MaxW]

Greetings Zabbix Community,

Trying to setup Zabbix to show incomming loggin by syslog log files.
I try to create an trigger which triggers when the last value occurs in the last 5 minutes of x amount of items.

The following expression is created:

count(/Syslog server/log[/test.log,"((?:[01]\d|2[0123]):(?:[012345]\d):(?:[012345]\d)).(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})",,,,\2],5m,"like","last(/Syslog server/log[/test.log,"((?:[01]\d|2[0123]):(?:[012345]\d):(?:[012345]\d)).(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})",,,,\2],#1)")>3

Also the following does not work:

count(/Syslog server/log[/test.log,"((?:[01]\d|2[0123]):(?:[012345]\d):(?:[012345]\d)).(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})",,,,\2],5m,"like","{ITEM.LASTVALUE}")>3

I'm sure the count function works like it should be, when i fill in de variable manually the item does trigger.
But when i try to get a value out of an other items which is containing the data is seems to not work.

Could someone tell me if this is even possible? Thanks and greetings.

[roman.rajniak]

Have you found solutions to this problem?
I try this using dependent item to simplify name of item key for reason to eliminate escaping " in name, but no change. Also I try to use the item type for integer values. (No success)
I think that fourth function count() parameter must be always a constant, and then for each ITEM.VALUE must exists trigger. - This isn't good way to solve comparing IP addresses in login.log .

[cyber]

I kind of understand, what you want to do... but...
You cannot create such a loop, that you feed items last value to a function as parameter...
if you look on definitions
count (/host/key,(sec|#num)<:time shift>,<operator>,<pattern>)
It is a "pattern" there, not a "{<MACRO>}, so you need to define a real pattern not a "lookup"...

Same goes with ITEM.LASTVALUE.. there are places where you can use it, but this is not one of them. In certain cases you can use user or LLD macro there...

https://www.zabbix.com/documentation/6.0/en/manual/appendix/macros/supported_by_location