Splunk Search

Can you use now() in eval-based macros?

Lowell
Super Champion

Is it possible to use the now() function in an macro? And if so, are there any specific limitations?

<p>Example macro:</p>

[test_macro]
definition = tostring(now())
iseval = 1

Trying to use this macro returns the following error message on the search screen:

Error in 'SearchParser': The definition of macro 'test_macro' is expected to be an eval expression that returns a string.

Update: For the purpose of demonstration, here are other macro definitions I tried when attempting to track this down:

[test_macro]
definition = now()
iseval = 1

[test_macro]
definition = strftime((now(), "%H:%M")
iseval = 1

[test_macro]
definition = a_non_existant_function()
iseval = 1

I see the same error message for all of these different macros.

This last test makes me think that the within the context of a macro, splunk sees now() just like "a_non_existant_function()" (which obviously doesn't exist). It would be nice to get a more specific error message saying that the eval is invalid because of a non-existing function.

Tags (2)
1 Solution

steveyz
Splunk Employee
Splunk Employee

Are you sure you want an eval-based definition? What is your use case?

If you want a macro that just evals to a string that represents the current time, use time() instead of now()

time() is the wall clock time. now() is the "nominal" start time of the search. For example, the scheduler may run a search that is supposed to start at 2PM but really started at 2:15pm, now() would still be 2pm)

Therefore, now() relys on run-time search info, which is not available for macro expansion. A macro needs to be able to be expanded outside the scope of a particular search.

There's some functions that are available in the eval command that are not available for eval-based macros. These include:

now()
searchmatch()
mvindex()
mvcount()
mvjoin()
commands()
split()
mvappend()

Basically, any function that needs manipulates search-search-result specific information (e.g., multi-value fields, the search that was run, etc)

View solution in original post

ldongradi_splun
Splunk Employee
Splunk Employee

An eval based macro must return a string.
tostring(now()) is not a string ... dough !
you need to ensapsulate it with double quotes
[macronow]
definition = "tostring(now())"
iseval = 1

To test with
|makeresults count=2 |eval show=strftime(macronow,"%D %T")

0 Karma

steveyz
Splunk Employee
Splunk Employee

Are you sure you want an eval-based definition? What is your use case?

If you want a macro that just evals to a string that represents the current time, use time() instead of now()

time() is the wall clock time. now() is the "nominal" start time of the search. For example, the scheduler may run a search that is supposed to start at 2PM but really started at 2:15pm, now() would still be 2pm)

Therefore, now() relys on run-time search info, which is not available for macro expansion. A macro needs to be able to be expanded outside the scope of a particular search.

There's some functions that are available in the eval command that are not available for eval-based macros. These include:

now()
searchmatch()
mvindex()
mvcount()
mvjoin()
commands()
split()
mvappend()

Basically, any function that needs manipulates search-search-result specific information (e.g., multi-value fields, the search that was run, etc)

View solution in original post

steveyz
Splunk Employee
Splunk Employee

yes mvappend() is new to 4.1+

0 Karma

Lowell
Super Champion

Is mvappend() new function? Its not in the docs, but I had submitted a feature request for such a function)

0 Karma

Lowell
Super Champion

Thanks, that answers my question. I was guessing that the answer had something to do with runtime search info. FYI, my use case is here: http://answers.splunk.com/questions/4528/finding-your-local-timezone-with-eval/4909#4909.

0 Karma

steveyz
Splunk Employee
Splunk Employee

Note that none of this applies if you aren't using an eval-based definition. Simple definitions are just doing text replacement, so anything goes.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Looks like a bug.

Lowell
Super Champion

I opened a case with splunk support. Thanks.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Does it work if you use strftime() instead of tostring()?

0 Karma

Lowell
Super Champion

No using strftime() doesn't make a difference. I've added a few more examples of things I've tried to my question. Seems like "now()" is unknown within the eval-based macro expansion.

0 Karma