Having trouble passing values in a macro to collect command.

ddelmont — Tue, 21 Jul 2020 19:35:55 GMT

Splunkers,

I sure hope this is just user error and I am myopic today!

Have a simple macro:

collectevents(2) args=index_parm,testmode_parm | addinfo | collect index=$index_parm$ testmode=$testmode_parm$ source=mysource

These both work:

`collectevents("Indexname",0)` `collectecents("Indexname","False")`

But these don't work:

stuff.... |eval index_parm="Indexname" |eval testmode_parm=0 `collectevents(index_parm,testmode_parm)`

When ever I pass a variable I get:

Error in 'SearchProcessor': Invalid option value. Expecting a 'boolean' for option 'testmode'. Instead got 'testmode_parm'.

It only complains about the testmode, but it's not passing the index_parm string correctly either. If I don't pass or remove testmode_parm, I stop getting an error but nothing shows up in the index. Crtl+Shift+E show index=index_parm. It's like the substitution is just not taking place.

Any ideas? Thank you.

Re: Having trouble passing values in a macro to collect command.

to4kawa — Tue, 21 Jul 2020 21:22:56 GMT

0 is string or number in this case, I guess.

Re: Having trouble passing values in a macro to collect command.

ddelmont — Tue, 21 Jul 2020 21:23:38 GMT

Thank you Murphy. Should have posted this sooner. Found a solution at:

https://community.splunk.com/t5/Knowledge-Management/collect-index-quot-based-on-values-quot/td-p/473593

topic Having trouble passing values in a macro to collect command. in Splunk Search

Having trouble passing values in a macro to collect command.

Re: Having trouble passing values in a macro to collect command.

Re: Having trouble passing values in a macro to collect command.