We have a wonderful set of end-users who can enter dates in various formats.
Data sample is like
reportName="finance" team="financeTeam" reportDate="2020-08-20"
reportName="finance" team="financeTeam" reportDate="2020-08-22"
...
The macro wanted to return the dataset for a specific date and expectation was user to enter
`getmyReport(2020-08-22)`
but some users, enter it as `getmyReport(today)` and my challenge is to ensure such weird inputs are tackled before it hits the search engine and to do directly in the raw data
So is there a way, i can do a pre-processing of my inputs before I pass it to the raw search?
the basic trial i've done is
|makeresults
| eval reportDate=if(reportDate="2020*",reportDate,strftime(now(),"%F")
| search (earliest=-7d index=xyz reportDate=$reportDate$)
but the above doesn't work.
The SECOND option I've within the macro outside the base search
index=xyz
| eval reportDate=if(reportDate="2020*",reportDate,strvtime(now(),"%F")
| search (reportDate=$reportDate$)
This SECOND option works, But somehow I feel the second option is performance wise poor (or will Splunk automatically optimise for Splunk 6.5x onwards?)
Is there a better option to pre-process macro variables before searching within _raw dataset?
