Tried many variations (enclosing arg in quotes, $, and backslash) and got many errors - mostly "expected to be an eval expression that returns a string."
[PACTime(1)] eval PacTime=strftime(relative_time($etime$,"-8h"),"%m/%d/%y %H:%M:%S")
EventID=6* | eval dtime=`PACTime(_time)`| table Host, dtime
Seems like this would be eval based, but tried both ways.
Any help appreciated.
When you substitute your macro back into the search, it looks like this -
EventID=6* | eval dtime=eval PacTime=strftime(relative_time(_time,"-8h"),"%m/%d/%y %H:%M:%S")| table Host, dtime
Seems like you have a double-eval in there.
Your macro is coded as if it were a function to return a value by assigning that value to the macro's name. That's not what macros actually do - they expand from their pattern and return a chunk of code for the search. This macro, as coded, is creating an unnecessary new field Pactime.
jdunlea's answer, which uses that field, is correct. however, there is a simpler solution. If you streamline the macro to just
then it should work fine without creating that unneeded field.
Just following up with this post, but did @jdunlea's answer below help solve your question? If yes, please confirm and accept the answer. If you found another answer that worked, please share. Thanks!
My guess is that it doesnt like the back ticks which are required for the macro. I would just set up the macro to run initially, bringing back the field "PacTime" and then eval "dtime" and set it to be the same as "PacTime".
... | PACTime(_time) | eval dtime=PacTime | ...