EventInstanceID needs event.eiid. Not event.eid.
Eval tool needs 'UNKOWN' as 'VAGUE'