Knowledge Management
Highlighted

How to escape "(" in macro arguments?

Path Finder

I pass values with parentheses to my macro. Need to escape the round brackets.

The following error was thrown:

PARSER: Applying intentions failed Error in 'SearchParser': Error for macro argument expression Arguments that start with '(' must end with ')'.

Seems replace allows only strings to used as a replace expression

Any suggestion welcome. Thanks

Tags (2)
0 Karma
Highlighted

Re: How to escape "(" in macro arguments?

Champion

replace does allow regex, please test it on the search app, i think there is a problem with xml.

0 Karma
Highlighted

Re: How to escape "(" in macro arguments?

Path Finder

Thank you for your response

replace(X, Y, Z)

I'm not sure if the Z argument can be anything other than string

0 Karma
Highlighted

Re: How to escape "(" in macro arguments?

SplunkTrust
SplunkTrust

Passing arguments with parentheses to macros should work well, here's a tiny example:

I've defined a macro echo(1) with the argument arg as follows:

"$arg$"

Using that, I've created a search like this:

| stats count | eval test = `echo("(Unauthenticated)177.177.9.9")`

That produces one event with a field test that contains the string (Unauthenticated)177.177.9.9, no error messages.

If you keep getting errors, post both your macro definition and the search you're trying to run.

0 Karma
Highlighted

Re: How to escape "(" in macro arguments?

SplunkTrust
SplunkTrust

Did you put quotes around it in the macro definition?

0 Karma
Highlighted

Re: How to escape "(" in macro arguments?

SplunkTrust
SplunkTrust

In my macro definition I did not escape the quotes - does that change anything for you?

0 Karma
Highlighted

Re: How to escape "(" in macro arguments?

SplunkTrust
SplunkTrust

I see - I used a non-eval-based macro, they behave differently in some ways... I'll take a look at those later, if noone else has a solution by then.

Highlighted

Re: How to escape "(" in macro arguments?

Champion

web("$userid$") , why do we need double quotes? Could you post the macro definition?

0 Karma
Highlighted

Re: How to escape "(" in macro arguments?

Champion

Does the macro give you the result when applied with some static value? And what macro does is just replace the value of the variable. When you pass like "$userid$", then in macro it becomes ""$userid$"", isn't it? and while converting the macro in XML it also makes it " , which is not supported by xml, need to replace it by " in definition.

0 Karma
Highlighted

Re: How to escape "(" in macro arguments?

Champion

Then it's the problem with the macro definition. it should give you the User_Name when you pass it in the search.

0 Karma