I'm trying to filter my data with the current day of week value using a macro. DAYOFWK is a field in my sourcetype
I get this error when trying below query with macro
Error in macro "The definition of macro is expected to be an eval expression that returns a string."
index=myindex sourcetype=mysourcetype DAYOF_WK=
if($dummy$==1, strftime(now(),"%w"), strftime(now(),"%w"))
Any idea on what I am doing wrong here?
I tried this stanza and it worked fine:
[dayofwk(1)] args = dummy definition = if($dummy$==1, strftime(now(),"%w"), strftime(now(),"%w"))
| gentimes start=-1 | eval zzz=`dayofwk(1)` | fields zzz
got me the expected value.
Did you put
iseval = true at the end of your stanza? If so, it's unnecessary.
I'm configuring it through WEB, and yes "Use eval-based definition?" is checked. Is it because I want to substitute this even before first pipe "|" and you are doing it in eval in your search query? does that matter? I want to filter this before first pipe |
even the eval after pipe | is not working for me | eval DAY=
dayofwk(1). I get the same error. Even tried the same query which you mentioned above and it doesn't work
Does my original query work if you uncheck the "Use eval-based definition" checkbox? If so, do that and structure your earlier query like this:
index=my_index sourcetype=mysourcetype | where DAY_OF_WK=`dayofwk(1)`
Yes, this is more inefficient. However, I have not figured out any way to get the macro to work with
iseval = true (which is the equivalent of your checkbox).
Ahh, I removed iseval=true and it worked. But I'm unable to use it before the first pipe. If I have to use it after the pipe, I don't need a macro in first place.
I figured out your real problem.
now() is not capable of being processed in a macro. See here:
I tried making an eval-based macro using
time() instead of
now() as described in the above link, adding
iseval=true, and using it as you wanted to use it above, and it worked fine. Give that a shot.
Awesome.. worked like a champ. Thank you so much 🙂