Hello,
i need a macro that acceppts a day and converts that into a format to it can be used in earliest and latest inside.
My idea:
createReport(1)
param: 'day', format='yyyy-MM-dd'
search=foo bar error NOT warning earliest=parseDayForEarliest($day$)
latest=parseDayForLatest($day$)
parseDayForEarliest(1)
param: 'day', format='yyyy-MM-dd'
strftime(strptime($day$,"%Y-%M-%d")-86400,"%m/%d/%Y:%H:%M:%S")
parseDayForLatest(1)
param: 'day', format='yyyy-MM-dd'
strftime(strptime($day$,"%Y-%M-%d"),"%m/%d/%Y:%H:%M:%S")
But it does not work 😞
Regards, Jens
Martin: It was that simple. I just was missing the quotes in the submacro.
In the main macro:
earliest=parseDayForEarliest("2013-03-13")
parseDayForEarliest(1)
strftime(strptime("$day$","%Y-%m-%d"),"%m/%d/%Y:%H:%M:%S")
eval-based defintion on.
Regards, Jens
First of all, %M is minute - you need %m for month.
That's not the main problem though... you cannot write earliest=some_function(...). You need to move that to a subsearch like this:
[stats count | eval earliest=relative_time(strptime("$day$","%Y-%m-%d"), "-d") | return earliest] [stats count | eval latest=strptime("$day$","%Y-%m-%d") | return latest]
Those subsearches can now be moved into a macro.
Don't blame strptime for that, just enclose $day$ in quotes. Else you end up computing 2013-03-27 as 1983.
Hi,
thanks for the answer and the correction for the strptime.
Your solution might work, but I disagree that i need to do it like this.
eval-based-defintion macros can be used here. Its just that i have problems to return the output as string. Tests are working fine with simple things, but not with strptime.
Regards, Jens