Getting Data In

Multiline macro writing format problem

crazyeva
Contributor

*emphasized text*i was defining a macro search
writing the search each pipe in one line like:
xxxx
|aaa
|bbb
|ccc
it failed to work.
but when i put them all in one line: xxxx|aaa|bbb|ccc, it worked
the error information was:
"Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression"
i tried to locate the problem, maybe a subsearch caused this error:
xxxx
|eval [search xxx
|return i]
|xxxx
which writing in one line will result as "xxxx|eval i=something|xxxx"
but "i" was not actually returned in multi-line mode.
is that bug? or macro search is not suggested to multiline way?

Tags (2)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

There is a bug in the macro when it is saved in the config file, unable to handle the linebreak char after a function. Go oneliner or finish the line with a pipe.

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

There is a bug in the macro when it is saved in the config file, unable to handle the linebreak char after a function. Go oneliner or finish the line with a pipe.

0 Karma

yannK
Splunk Employee
Splunk Employee

This is planned to be fixed in next patch version (likely 6.0.1 and 5.0.6). See SPL-72399 in the changelog once released for details.

0 Karma

phoenixdigital
Builder

Is this bug ever going to be fixed?

I have some very complex macros that are much easier to read and edit when they are split over multiple lines?

Edit: I tried the finish each line with a pipe but that didnt seem to work.

0 Karma

crazyeva
Contributor

Thank you.

0 Karma

crazyeva
Contributor

by the way, "xxx|bucket _time span=30m|xxx" works well in oneline, but goes wrong in multi lines, unless change it a little: "xxx|bucket span=30m _time|xxx"

0 Karma
Get Updates on the Splunk Community!

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options A recent Tech Talk, ...

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...