Create search macro with return value

[yko84109]

Hi,

I want to create my search macro to return new field.
Example:

my_search_macro("1")

I want to return a new field, test, that contains "your value is " + $arg$

What I'm tried to write in search macro definition:

|eval test="your value is " + $arg$

But when I execute my search command as follow:

|makeresults | eval msg = my_search_macro("1") | table msg

I got an error.
So how can I simply create search macro with return value?

Thanks

[richgalloway]

Macros are simple text substitutions, not functions. Your example query expands to | makeresults | eval msg = eval test="your value is foo" | table msg, which is why you get an error. Try changing the macro to "your value is " + $arg$ and be sure to check the "eval" box.