Knowledge Management

Why is my macro returning error "expected to be an eval expression that returns a string." with my current definition?


Tried many variations (enclosing arg in quotes, $, and backslash) and got many errors - mostly "expected to be an eval expression that returns a string."

eval PacTime=strftime(relative_time($etime$,"-8h"),"%m/%d/%y %H:%M:%S")

Called as

EventID=6* | eval dtime=`PACTime(_time)`| table Host, dtime

Seems like this would be eval based, but tried both ways.
Any help appreciated.

Tags (1)
0 Karma


When you substitute your macro back into the search, it looks like this -

EventID=6* | eval dtime=eval PacTime=strftime(relative_time(_time,"-8h"),"%m/%d/%y %H:%M:%S")| table Host, dtime

Seems like you have a double-eval in there.

Your macro is coded as if it were a function to return a value by assigning that value to the macro's name. That's not what macros actually do - they expand from their pattern and return a chunk of code for the search. This macro, as coded, is creating an unnecessary new field Pactime.

jdunlea's answer, which uses that field, is correct. however, there is a simpler solution. If you streamline the macro to just

strftime(relative_time($etime$,"-8h"),"%m/%d/%y %H:%M:%S")

then it should work fine without creating that unneeded field.

0 Karma

Community Manager
Community Manager

HI @rgcox1

Just following up with this post, but did @jdunlea's answer below help solve your question? If yes, please confirm and accept the answer. If you found another answer that worked, please share. Thanks!

0 Karma

Path Finder

My guess is that it doesnt like the back ticks which are required for the macro. I would just set up the macro to run initially, bringing back the field "PacTime" and then eval "dtime" and set it to be the same as "PacTime".

EG: ... | PACTime(_time) | eval dtime=PacTime | ...

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!