topic Re: Why nested macros using the same argument wont work when the argument has strings in double quotes? in Splunk Search

Why nested macros using the same argument wont work when the argument has strings in double quotes?

joshiro — Fri, 03 Mar 2023 15:21:54 GMT

We have this scenario where two nested macros using the same argument raises an error at the parsing of the second one because of the double quotes in the arguments dissapear.

If we define the two macros as the following:
"test_args2(1)" -> `test_args("$args$")`
"test_args(1)" -> | eval arguments = $args$

And then run the following search:

It raises the following error:

And the search log shows that after expanding the first macro then it removes the double quotations from the argument:

PARSING: | makeresults \n`test_arguments2("[| makeresults | eval arguments = tostring(floor(relative_time(_time, "@y"))) | return $arguments]")`\n| table arguments
AFTER EXPANDING MACROS: | makeresults \n| eval arguments = [| makeresults | eval arguments = tostring(floor(relative_time(_time, @y))) | return $arguments]\n| table arguments

It doesnt work either if we scape the doble quotes as:

Has anyone encounter a similar issue? How did you get around it or solve it?

Re: Why nested macros using the same argument wont work when the argument has strings in double quotes?

joshiro — Tue, 07 Mar 2023 17:23:37 GMT

We managed get a workaround this issue by creating a third macro with the whole string we are passing as the argument:

`args` -> | makeresults | eval arguments = tostring(floor(relative_time(_time, "@y"))) | return $arguments

Now we can run he following SPL without the parsing error:

| makeresults `test_arguments2("[`args`]")` | table arguments

By using the third macro with the arguments, we avoid Splunk to parse the arguments directly and removing the double quotes.

Re: Why nested macros using the same argument wont work when the argument has strings in double quotes?

PickleRick — Tue, 07 Mar 2023 20:35:11 GMT

You're expanding arguments twice so you might need escaping them twice.

`test_arguments2("\"[| makeresults | eval arguments = tostring(floor(relative_time(_time, \"@y\"))) | return $arguments]\"")`

The '@y' part could also use escaping backslashes so that it turns into \\\"@y\\\"

Yes, nested (un)escaping can be a PITA

Re: Why nested macros using the same argument wont work when the argument has strings in double quotes?

joshiro — Wed, 08 Mar 2023 16:08:10 GMT

Thanks for the feedback.

This approach is also working correctly, no longer raises the same error when removes the double quotes from the "@y".
But it wont work if you nest the macros more than 2 times.

Re: Why nested macros using the same argument wont work when the argument has strings in double quotes?

PickleRick — Wed, 08 Mar 2023 16:53:44 GMT

It should work. But you'll need so much more escaping that your head will spin since all escaped backslashes will need escaping again. (same goes often in bash scripts - my record was something similar to \\\\\\\\" 🤣)

Re: Why nested macros using the same argument wont work when the argument has strings in double quotes?

joshiro — Wed, 08 Mar 2023 18:03:20 GMT

Yes, that is what we thought, but since we dont know how much nesting depth we are going to use, we just cant hardcode the escaped backslashes all the way down.