macro with eval-based definition: error - the definition is expected to be an eval expression that returns a string.

[daveloaiza]

Hoping to use a macro to simplify search terms as follows:

index=my_index sourcetype=my_sourcetype splunk_servers=`splunk_domain(west)`

A macro is set up to take one argument, $splunk_domain$, and the definition is currently as follows:

case(tostring($splunk_domain$)=="west","*.domain.west",tostring($splunk_domain$)=="east","*.domain.east",tostring($splunk_domain$)=="corp","*.domain.corp",true(),*)

Use eval-based definition option is enabled. I have tried several different combinations of double quotes and the tostring() function on both the case conditions and outputs. I have also tried changing the definition to

eval splunk_server= case(tostring($splunk_domain$)=="west", "*.domain.west",tostring($splunk_domain$)=="east", "*.domain.east",tostring($splunk_domain$)=="corp","*.domain.corp",true(),*)

and changing the search to

index=my_index sourcetype=my_sourcetype `splunk_domain(west)`

This all seems to return the same "expected string" error message. Doing all this from the GUI as I don't have access to macros.conf.

Is this a valid use of macros, and if so, what needs to change so that the expected string is returned?

[martin_mueller · Accepted solution]

The first definition looks good, except for the final option inside your case expression - * is not a string, "*" would be. That will get rid of the error message.

That won't yet get you the results you want though, because as-is the eval expression will treat the west you put in as a name, not as a string. You'll have to add quotes around the argument to force a string:

case("$splunk_domain$"=="west", "*.domain.west", "$splunk_domain$"=="east", "*.domain.east", "$splunk_domain$"=="corp", "*.domain.corp", true(), "*")

Looks weird, but that ^ works.

[daveloaiza]

Sure enough, this worked. Thanks Martin!