Knowledge Management

macro with eval-based definition: error - the definition is expected to be an eval expression that returns a string.

daveloaiza
Engager

Hoping to use a macro to simplify search terms as follows:

index=my_index sourcetype=my_sourcetype splunk_servers=`splunk_domain(west)`

A macro is set up to take one argument, $splunk_domain$, and the definition is currently as follows:

case(tostring($splunk_domain$)=="west","*.domain.west",tostring($splunk_domain$)=="east","*.domain.east",tostring($splunk_domain$)=="corp","*.domain.corp",true(),*)

Use eval-based definition option is enabled. I have tried several different combinations of double quotes and the tostring() function on both the case conditions and outputs. I have also tried changing the definition to

eval splunk_server= case(tostring($splunk_domain$)=="west", "*.domain.west",tostring($splunk_domain$)=="east", "*.domain.east",tostring($splunk_domain$)=="corp","*.domain.corp",true(),*)

and changing the search to

index=my_index sourcetype=my_sourcetype `splunk_domain(west)`

This all seems to return the same "expected string" error message. Doing all this from the GUI as I don't have access to macros.conf.

Is this a valid use of macros, and if so, what needs to change so that the expected string is returned?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

The first definition looks good, except for the final option inside your case expression - * is not a string, "*" would be. That will get rid of the error message.

That won't yet get you the results you want though, because as-is the eval expression will treat the west you put in as a name, not as a string. You'll have to add quotes around the argument to force a string:

case("$splunk_domain$"=="west", "*.domain.west", "$splunk_domain$"=="east", "*.domain.east", "$splunk_domain$"=="corp", "*.domain.corp", true(), "*")

Looks weird, but that ^ works.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

The first definition looks good, except for the final option inside your case expression - * is not a string, "*" would be. That will get rid of the error message.

That won't yet get you the results you want though, because as-is the eval expression will treat the west you put in as a name, not as a string. You'll have to add quotes around the argument to force a string:

case("$splunk_domain$"=="west", "*.domain.west", "$splunk_domain$"=="east", "*.domain.east", "$splunk_domain$"=="corp", "*.domain.corp", true(), "*")

Looks weird, but that ^ works.

daveloaiza
Engager

Sure enough, this worked. Thanks Martin!

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...