How to return string in macro after some logics

madhavanv — Sat, 20 Aug 2022 19:27:59 GMT

I have following eval based macro to return a string, in the end I am expecting macro to return something like "earliest=08/20/2022:18:39:14 latest=08/20/2022:18:55:14"
so that i can use it in search as follows.

index=main org_name="cards-org" app_name="service-prod"
`search_range("2022-08-20 19:15:14.104",2)`| table _time msg

But I am getting below error. Please help to understand what is wrong with this and how to achieve this.

"Error in 'SearchParser': The definition of macro 'search_range(2)' is expected to be an eval expression that returns a string."

Eval based macro definition as follows.

| makeresults
|eval Date="$daterange$"
| eval minutes=$seconds$
| eval formattedEarlyts = strftime((strptime(Date, "%Y-%m-%d %H:%M:%S.%3N") - (minutes * 60)),"%m/%d/%Y:%H:%M:%S")
| eval formattedLatestts = strftime((strptime(Date, "%Y-%m-%d %H:%M:%S.%3N") + (minutes * 60)),"%m/%d/%Y:%H:%M:%S")
| eval timerange= " earliest="+formattedEarlyts+" "+"latest="+formattedLatestts
| fields - Date minutes formattedEarlyts formattedLatestts
| eval case (1==1,timerange)

Re: How to return string in macro after some logics

yuanliu — Sat, 20 Aug 2022 21:07:23 GMT

The error is as it says, the macro can only contain an eval expression, not full search commands. For example, you can put

$a$

in an eval-base macro, or

$a$ + $b$

"\"" . strftime((strptime($daterange$, "%Y-%m-%d %H:%M:%S.%3N") - $seconds$ * 60)),"%m/%d/%Y:%H:%M:%S") . "\""

in eval-based macro

topic How to return string in macro after some logics in Splunk Search

How to return string in macro after some logics

Re: How to return string in macro after some logics