Macro with eval-based definition submacro to set earliest and latest

[JensT]

Hello,

i need a macro that acceppts a day and converts that into a format to it can be used in earliest and latest inside.
My idea:

createReport(1)
param: 'day', format='yyyy-MM-dd'
search=foo bar error NOT warning earliest=parseDayForEarliest($day$) latest=parseDayForLatest($day$)

parseDayForEarliest(1)
param: 'day', format='yyyy-MM-dd'
strftime(strptime($day$,"%Y-%M-%d")-86400,"%m/%d/%Y:%H:%M:%S")

parseDayForLatest(1)
param: 'day', format='yyyy-MM-dd'
strftime(strptime($day$,"%Y-%M-%d"),"%m/%d/%Y:%H:%M:%S")

But it does not work 😞

Regards, Jens

[JensT]

Martin: It was that simple. I just was missing the quotes in the submacro.

In the main macro:
earliest=parseDayForEarliest("2013-03-13")

parseDayForEarliest(1)
strftime(strptime("$day$","%Y-%m-%d"),"%m/%d/%Y:%H:%M:%S")
eval-based defintion on.

Regards, Jens

[martin_mueller]

First of all, %M is minute - you need %m for month.

That's not the main problem though... you cannot write earliest=some_function(...). You need to move that to a subsearch like this:

[stats count | eval earliest=relative_time(strptime("$day$","%Y-%m-%d"), "-d") | return earliest] [stats count | eval latest=strptime("$day$","%Y-%m-%d") | return latest]

Those subsearches can now be moved into a macro.

[martin_mueller]

Don't blame strptime for that, just enclose $day$ in quotes. Else you end up computing 2013-03-27 as 1983.

[JensT]

Hi,

thanks for the answer and the correction for the strptime.

Your solution might work, but I disagree that i need to do it like this.
eval-based-defintion macros can be used here. Its just that i have problems to return the output as string. Tests are working fine with simple things, but not with strptime.

Regards, Jens