<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic single-argument macro will not work (but argumentless version does) in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/single-argument-macro-will-not-work-but-argumentless-version/m-p/21065#M162</link>
    <description>&lt;P&gt;Consider the following pair of macros, the former of which functions as expected whereas the latter fails with an error:&lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;&lt;BR /&gt;
[fl] # stands for First and Last&lt;BR /&gt;
definition = stats count min(_time) as FIRST, max(_time) as LAST by source | convert ctime(FIRST) timeformat="%m/%d/%y %H:%M" | convert ctime(LAST) timeformat="%m/%d/%y %H:%M"&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;[fl(1)] # stands for First and Last&lt;BR /&gt;
args StatsBy&lt;BR /&gt;
definition = stats count min(_time) as FIRST, max(_time) as LAST by $StatsBy$ | convert ctime(FIRST) timeformat="%m/%d/%y %H:%M" | convert ctime(LAST) timeformat="%m/%d/%y %H:%M"&lt;BR /&gt;
&lt;/P&gt;

&lt;P&gt;The error I get is this:&lt;BR /&gt;
Error in 'SearchParser': Could not find macro 'fl' that takes 1 arguments. Expecting stanza name 'fl(1)'.&lt;/P&gt;</description>
    <pubDate>Mon, 28 Sep 2020 10:08:36 GMT</pubDate>
    <dc:creator>woodcock</dc:creator>
    <dc:date>2020-09-28T10:08:36Z</dc:date>
    <item>
      <title>single-argument macro will not work (but argumentless version does)</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/single-argument-macro-will-not-work-but-argumentless-version/m-p/21065#M162</link>
      <description>&lt;P&gt;Consider the following pair of macros, the former of which functions as expected whereas the latter fails with an error:&lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;&lt;BR /&gt;
[fl] # stands for First and Last&lt;BR /&gt;
definition = stats count min(_time) as FIRST, max(_time) as LAST by source | convert ctime(FIRST) timeformat="%m/%d/%y %H:%M" | convert ctime(LAST) timeformat="%m/%d/%y %H:%M"&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;[fl(1)] # stands for First and Last&lt;BR /&gt;
args StatsBy&lt;BR /&gt;
definition = stats count min(_time) as FIRST, max(_time) as LAST by $StatsBy$ | convert ctime(FIRST) timeformat="%m/%d/%y %H:%M" | convert ctime(LAST) timeformat="%m/%d/%y %H:%M"&lt;BR /&gt;
&lt;/P&gt;

&lt;P&gt;The error I get is this:&lt;BR /&gt;
Error in 'SearchParser': Could not find macro 'fl' that takes 1 arguments. Expecting stanza name 'fl(1)'.&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 10:08:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/single-argument-macro-will-not-work-but-argumentless-version/m-p/21065#M162</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2020-09-28T10:08:36Z</dc:date>
    </item>
    <item>
      <title>Re: single-argument macro will not work (but argumentless version does)</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/single-argument-macro-will-not-work-but-argumentless-version/m-p/21066#M163</link>
      <description>&lt;P&gt;It seems like you're missing the equal sign after your &lt;CODE&gt;args&lt;/CODE&gt; of the second stanza.&lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;[fl(1)] # stands for First and Last &lt;BR /&gt;
args = StatsBy &lt;BR /&gt;
definition = stats count min(_time) as FIRST, max(_time) as LAST by $StatsBy$ | convert ctime(FIRST) timeformat="%m/%d/%y %H:%M" | convert ctime(LAST) timeformat="%m/%d/%y %H:%M"&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;Hope this helps.&lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;&amp;gt; please upvote and accept answer if you find it useful - thanks!&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 22 Nov 2011 23:11:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/single-argument-macro-will-not-work-but-argumentless-version/m-p/21066#M163</guid>
      <dc:creator>_d_</dc:creator>
      <dc:date>2011-11-22T23:11:25Z</dc:date>
    </item>
  </channel>
</rss>

