https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-modify-a-function-in-a-report-for-Splunk-App-for-Unix-and/m-p/171702#M16467 <P>Hi, I found the macros.conf file for this and commented out the original macro and replaced with what you gave. I get this error when I try and run the report now, I am pretty new to this so honestly dont know which part would be causing...</P> <P>Error in 'eval' command: The expression is malformed. An unexpected character is reached at '*."\""'.</P> <P>If its an easy one I would appreciate it <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Thank you for the help!</P> Wed, 06 Aug 2014 14:12:46 GMT soleblazer 2014-08-06T14:12:46Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-modify-a-function-in-a-report-for-Splunk-App-for-Unix-and/m-p/171700#M16465 <P>Hi there.</P> <P>I'm fairly new to Splunk, so apologize if this is an easy one. I have setup Splunk's App for Unix..its collecting all the info very well from about 10 servers. My question is about the Reports that it provides. In the search app, if I go to reports I see lots of great reports created by the Splunk App for Unix. There is one that shows load average. I want to modify that so I can only show just certain groups of hosts. If I edit, instead of the search language, I just see a function in the search bar called <CODE>Percent_Load_by_Host(*)</CODE> </P> <P>I'd like to be able to do something like 'Percent_Load_by_Host(server1,server3,etc) but if I enter more than one field it complains. So my question is, how can I modify this report and be able to use it for more than just showing the load average for everything? Thank you very much, still learning this.</P> Mon, 28 Sep 2020 17:16:21 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-modify-a-function-in-a-report-for-Splunk-App-for-Unix-and/m-p/171700#M16465 soleblazer 2020-09-28T17:16:21Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-modify-a-function-in-a-report-for-Splunk-App-for-Unix-and/m-p/171701#M16466 <P>It is a macro and its definitions is like this (macros.conf)</P> <PRE><CODE>[Percent_Load_by_Host(1)] args = host definition = `os_index` `memory_sourcetype` host=$host$ | timechart avg(loadAvg1mi) by host </CODE></PRE> <P>Change the defintion to something like this</P> <PRE><CODE>[Percent_Load_by_Host(1)] args = host definition = `os_index` `memory_sourcetype` [|gentimes start=-1 | eval host="\"".$host$."\"" | table host | makemv host delim="," | mvexpand host ] | timechart avg(loadAvg1mi) by host </CODE></PRE> <P>Now you can pass <CODE>"*"</CODE> or comma separated list of host (host1,host2,host3).</P> Tue, 05 Aug 2014 18:37:35 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-modify-a-function-in-a-report-for-Splunk-App-for-Unix-and/m-p/171701#M16466 somesoni2 2014-08-05T18:37:35Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-modify-a-function-in-a-report-for-Splunk-App-for-Unix-and/m-p/171702#M16467 <P>Hi, I found the macros.conf file for this and commented out the original macro and replaced with what you gave. I get this error when I try and run the report now, I am pretty new to this so honestly dont know which part would be causing...</P> <P>Error in 'eval' command: The expression is malformed. An unexpected character is reached at '*."\""'.</P> <P>If its an easy one I would appreciate it <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Thank you for the help!</P> Wed, 06 Aug 2014 14:12:46 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-modify-a-function-in-a-report-for-Splunk-App-for-Unix-and/m-p/171702#M16467 soleblazer 2014-08-06T14:12:46Z