Taking a Udemy Splunk introductory course module about macros.
The string works fine in Search, but not as a macro named fileinfo - get the above error.
index=web
| eval megabytes=bytes/1024/1024
| stats sum(megabytes) as "Megs" by file
| sort – Megs
Change the definition of the macro to not be an eval macro by unchecking the "Use eval-based definition" box. Eval-based definitions are for macros that return a string value. The fileinfo macro returns a result set so is not an eval.
Change the definition of the macro to not be an eval macro by unchecking the "Use eval-based definition" box. Eval-based definitions are for macros that return a string value. The fileinfo macro returns a result set so is not an eval.