Issue in returning space from eval macro

keerthana_k — Wed, 26 Feb 2014 07:30:00 GMT

Hi,

I am in need of an eval macro that takes in three values, examines them and returns the values for three separate fields. I need to return all the three values at once. My macro definition looks like this:

[my_macro(3)]
args = val1,val2,val3
definition = case("$val1$"!="*" AND "$val2$"!="*" AND $val3$=="*","Field1=\"$val1$\" Field2=\"$val2$\" Field3=\"*\"", "$val1$"!="*" AND "$val2$"=="*" AND $val3$!="*","$Field1$=\"$val1$\" Field2=\"*\" Field3=\"$val3$\"", "$val1$"=="*" AND "$val2$"!="*" AND $val3$!="*","$Field1$=\"*\" Field2=\"$val2$\" Field3=\"$val3$\"", "$val1$"=="*" AND "$val2$"=="*" AND $val3$!="*","$Field1$=\"-\" Field2=\"-\" Field3=\"$val3$\"", "$val1$"=="*" AND "$val2$"!="*" AND $val3$=="*","$Field1$=\"-\" Field2=\"$val2$\" Field3=\"-\"", "$val1$"!="*" AND "$val2$"=="*" AND $val3$=="*","$Field1$=\"$val1$\" Field2=\"-\" Field3=\"-\"", "$val1$"=="*" AND "$val2$"=="*" AND $val3$=="*","$Field1$=\"-\" Field2=\"-\" Field3=\"-\"", "$val1$"!="*" AND "$val2$"!="*" AND $val3$!="*","$Field1$=\"$val1$\" Field2=\"$val2$\" Field3=\"$val3$\"")
iseval = 1

When I use this macro in any of my search queries I get the following error:

The definition of macro 'my_macro(3)' is expected to be an eval expression that returns a string.

The values val1, val2 and val3 are obtained from dropdowns in the view

Below is my search query:

index=myIndex earliest=<time> latest=<time> `my_macro($val1$,$val2$,$val3$)` | bucket _time span=span | stats ....

Please let me know where I am going wrong and how I can achieve this.

Thanks

Keerthana

Re: Issue in returning space from eval macro

linu1988 — Wed, 26 Feb 2014 08:56:40 GMT

What is the search command are you performing could you post that too?

Re: Issue in returning space from eval macro

keerthana_k — Wed, 26 Feb 2014 09:36:11 GMT

I have edited the question to include the search too.

Re: Issue in returning space from eval macro

linu1988 — Wed, 26 Feb 2014 10:06:27 GMT

Hello Keerthana,
It's not the macro it's your search which is failing.

index=myIndex earliest=<time> latest=<time> |eval a=`my_macro($val1$,$val2$,$val3$)` | bucket _time span=span | stats ....

if it gives you some error see the inspect link and figure out the error in the replaced search command.

Thanks

topic Issue in returning space from eval macro in Splunk Search

Issue in returning space from eval macro

Re: Issue in returning space from eval macro

Re: Issue in returning space from eval macro

Re: Issue in returning space from eval macro