I pass values with parentheses to my macro. Need to escape the round brackets.
The following error was thrown:
PARSER: Applying intentions failed Error in 'SearchParser': Error for macro argument expression Arguments that start with '(' must end with ')'.
replace allows only strings to used as a replace expression
Any suggestion welcome. Thanks
Passing arguments with parentheses to macros should work well, here's a tiny example:
I've defined a macro
echo(1) with the argument
arg as follows:
Using that, I've created a search like this:
| stats count | eval test = `echo("(Unauthenticated)184.108.40.206")`
That produces one event with a field
test that contains the string
(Unauthenticated)220.127.116.11, no error messages.
If you keep getting errors, post both your macro definition and the search you're trying to run.
I see - I used a non-eval-based macro, they behave differently in some ways... I'll take a look at those later, if noone else has a solution by then.
Does the macro give you the result when applied with some static value? And what macro does is just replace the value of the variable. When you pass like "$userid$", then in macro it becomes ""$userid$"", isn't it? and while converting the macro in XML it also makes it " , which is not supported by xml, need to replace it by " in definition.