topic Re: Can you use now() in eval-based macros? in Splunk Search

Can you use now() in eval-based macros?

Lowell — Mon, 28 Sep 2020 09:10:31 GMT

Is it possible to use the now() function in an macro? And if so, are there any specific limitations?

<p>Example macro:</p>

[test_macro]
definition = tostring(now())
iseval = 1

Trying to use this macro returns the following error message on the search screen:

Error in 'SearchParser': The definition of macro 'test_macro' is expected to be an eval expression that returns a string.

Update: For the purpose of demonstration, here are other macro definitions I tried when attempting to track this down:

[test_macro]
definition = now()
iseval = 1

[test_macro]
definition = strftime((now(), "%H:%M")
iseval = 1

[test_macro]
definition = a_non_existant_function()
iseval = 1

I see the same error message for all of these different macros.

This last test makes me think that the within the context of a macro, splunk sees now() just like "a_non_existant_function()" (which obviously doesn't exist). It would be nice to get a more specific error message saying that the eval is invalid because of a non-existing function.

Re: Can you use now() in eval-based macros?

gkanapathy — Thu, 22 Jul 2010 05:59:59 GMT

Does it work if you use strftime() instead of tostring()?

Re: Can you use now() in eval-based macros?

Lowell — Thu, 22 Jul 2010 22:23:09 GMT

No using strftime() doesn't make a difference. I've added a few more examples of things I've tried to my question. Seems like "now()" is unknown within the eval-based macro expansion.

Re: Can you use now() in eval-based macros?

gkanapathy — Thu, 22 Jul 2010 23:13:11 GMT

Looks like a bug.

Re: Can you use now() in eval-based macros?

Lowell — Fri, 23 Jul 2010 01:40:29 GMT

I opened a case with splunk support. Thanks.

Re: Can you use now() in eval-based macros?

steveyz — Fri, 23 Jul 2010 04:30:14 GMT

Are you sure you want an eval-based definition? What is your use case?

If you want a macro that just evals to a string that represents the current time, use time() instead of now()

time() is the wall clock time. now() is the "nominal" start time of the search. For example, the scheduler may run a search that is supposed to start at 2PM but really started at 2:15pm, now() would still be 2pm)

Therefore, now() relys on run-time search info, which is not available for macro expansion. A macro needs to be able to be expanded outside the scope of a particular search.

There's some functions that are available in the eval command that are not available for eval-based macros. These include:

now()
searchmatch()
mvindex()
mvcount()
mvjoin()
commands()
split()
mvappend()

Basically, any function that needs manipulates search-search-result specific information (e.g., multi-value fields, the search that was run, etc)

Re: Can you use now() in eval-based macros?

steveyz — Fri, 23 Jul 2010 04:31:26 GMT

Note that none of this applies if you aren't using an eval-based definition. Simple definitions are just doing text replacement, so anything goes.

Re: Can you use now() in eval-based macros?

Lowell — Mon, 02 Aug 2010 22:11:38 GMT

Thanks, that answers my question. I was guessing that the answer had something to do with runtime search info. FYI, my use case is here: http://answers.splunk.com/questions/4528/finding-your-local-timezone-with-eval/4909#4909.

Re: Can you use now() in eval-based macros?

Lowell — Mon, 02 Aug 2010 22:12:50 GMT

Is mvappend() new function? Its not in the docs, but I had submitted a feature request for such a function)

Re: Can you use now() in eval-based macros?

steveyz — Tue, 03 Aug 2010 03:38:26 GMT

yes mvappend() is new to 4.1+

Re: Can you use now() in eval-based macros?

ldongradi_SPL — Tue, 30 Oct 2018 12:47:27 GMT

An eval based macro must return a string.
tostring(now()) is not a string ... dough !
you need to ensapsulate it with double quotes
[macronow] definition = "tostring(now())" iseval = 1

To test with
|makeresults count=2 |eval show=strftime(macronow,"%D %T")

Re: Can you use now() in eval-based macros?

thambisetty — Sat, 24 Feb 2024 03:31:46 GMT

you are 200% correct.
to use iseval = 1
we must specify the definition within double quotes.