Error in 'SearchParser': The definition of macro 'fileinfo' is expected to be an eval expression that returns a string.

[nickt3]

Taking a Udemy Splunk introductory course module about macros.

The string works fine in Search, but not as a macro named fileinfo - get the above error. 

index=web

| eval megabytes=bytes/1024/1024

| stats sum(megabytes) as "Megs" by file

| sort – Megs

[richgalloway · Accepted solution]

Change the definition of the macro to not be an eval macro by unchecking the "Use eval-based definition" box.  Eval-based definitions are for macros that return a string value.  The fileinfo macro returns a result set so is not an eval.