Why is my macro returning error "expected to be an eval expression that returns a string." with my current definition?

[rgcox1]

Tried many variations (enclosing arg in quotes, $, and backslash) and got many errors - mostly "expected to be an eval expression that returns a string."
Definition:

[PACTime(1)]
eval PacTime=strftime(relative_time($etime$,"-8h"),"%m/%d/%y %H:%M:%S")

Called as

EventID=6* | eval dtime=`PACTime(_time)`| table Host, dtime

Seems like this would be eval based, but tried both ways.
Any help appreciated.

[DalJeanis]

When you substitute your macro back into the search, it looks like this -

EventID=6* | eval dtime=eval PacTime=strftime(relative_time(_time,"-8h"),"%m/%d/%y %H:%M:%S")| table Host, dtime

Seems like you have a double-eval in there.

Your macro is coded as if it were a function to return a value by assigning that value to the macro's name. That's not what macros actually do - they expand from their pattern and return a chunk of code for the search. This macro, as coded, is creating an unnecessary new field Pactime.

jdunlea's answer, which uses that field, is correct. however, there is a simpler solution. If you streamline the macro to just

strftime(relative_time($etime$,"-8h"),"%m/%d/%y %H:%M:%S")

then it should work fine without creating that unneeded field.

[ppablo]

HI @rgcox1

Just following up with this post, but did @jdunlea's answer below help solve your question? If yes, please confirm and accept the answer. If you found another answer that worked, please share. Thanks!

[jdunlea]

My guess is that it doesnt like the back ticks which are required for the macro. I would just set up the macro to run initially, bringing back the field "PacTime" and then eval "dtime" and set it to be the same as "PacTime".

EG: ... | PACTime(_time) | eval dtime=PacTime | ...