topic Re: Eval macro with string argument in Splunk Search

Eval macro with string argument

MatMeredith — Fri, 17 May 2013 10:48:02 GMT

I'm trying to define a Splunk eval based macro that takes a string as a parameter (where the string must be able to contain spaces), tests the value of the string, and then returns a value based on the outcome of that test. But I can't get it to work. Taking as a simplified example...

Macro definition:

if ($arg1$=="Test String", "true", "false")

Macro invocation:

`name("Test String")`

The macro always evaluates to false. I've tried every combination of single and double quotes that I can think of in both the macro definition and invocation, but I can't seem to get this to work. Am I missing something?

Thanks!

Re: Eval macro with string argument

linu1988 — Fri, 17 May 2013 11:40:42 GMT

Hello Mat,
please write the macro definiton as:

" if ($arg1$=="Test String", "true", "false")

and call the eval statement as "eval a=`macro_name((Backslash)\"Test String(Backslash)\")" as double quote will give you error

Re: Eval macro with string argument

martin_mueller — Fri, 17 May 2013 11:51:13 GMT

Define your macro as follows:

if("$arg1$"=="test","true","false")

The quotes around $arg1$ are necessary. Then the value placed into the macro content by string substitution again gets treated as a string rather than as a reference to a field.

Re: Eval macro with string argument

linu1988 — Fri, 17 May 2013 12:05:27 GMT

Hello Martin,
both the scenario works for me, just had to tweak the passing of arguments.

Re: Eval macro with string argument

MatMeredith — Mon, 20 May 2013 08:52:13 GMT

Perfect -- thank you Martin.