Can you use now() in eval-based macros?

[Lowell]

Is it possible to use the now() function in an macro? And if so, are there any specific limitations?

<p>Example macro:</p>

[test_macro]
definition = tostring(now())
iseval = 1

Trying to use this macro returns the following error message on the search screen:

Error in 'SearchParser': The definition of macro 'test_macro' is expected to be an eval expression that returns a string.

Update: For the purpose of demonstration, here are other macro definitions I tried when attempting to track this down:

[test_macro]
definition = now()
iseval = 1

[test_macro]
definition = strftime((now(), "%H:%M")
iseval = 1

[test_macro]
definition = a_non_existant_function()
iseval = 1

I see the same error message for all of these different macros.

This last test makes me think that the within the context of a macro, splunk sees now() just like "a_non_existant_function()" (which obviously doesn't exist). It would be nice to get a more specific error message saying that the eval is invalid because of a non-existing function.

[ldongradi_splun]

An eval based macro must return a string.
tostring(now()) is not a string ... dough !
you need to ensapsulate it with double quotes
[macronow]
definition = "tostring(now())"
iseval = 1

To test with
|makeresults count=2 |eval show=strftime(macronow,"%D %T")

[steveyz · Accepted solution]

Are you sure you want an eval-based definition? What is your use case?

If you want a macro that just evals to a string that represents the current time, use time() instead of now()

time() is the wall clock time. now() is the "nominal" start time of the search. For example, the scheduler may run a search that is supposed to start at 2PM but really started at 2:15pm, now() would still be 2pm)

Therefore, now() relys on run-time search info, which is not available for macro expansion. A macro needs to be able to be expanded outside the scope of a particular search.

There's some functions that are available in the eval command that are not available for eval-based macros. These include:

now()
searchmatch()
mvindex()
mvcount()
mvjoin()
commands()
split()
mvappend()

Basically, any function that needs manipulates search-search-result specific information (e.g., multi-value fields, the search that was run, etc)

[steveyz]

yes mvappend() is new to 4.1+

[Lowell]

Is mvappend() new function? Its not in the docs, but I had submitted a feature request for such a function)

[Lowell]

Thanks, that answers my question. I was guessing that the answer had something to do with runtime search info. FYI, my use case is here: http://answers.splunk.com/questions/4528/finding-your-local-timezone-with-eval/4909#4909.

[steveyz]

Note that none of this applies if you aren't using an eval-based definition. Simple definitions are just doing text replacement, so anything goes.

[gkanapathy]

Looks like a bug.

[Lowell]

I opened a case with splunk support. Thanks.

[gkanapathy]

Does it work if you use strftime() instead of tostring()?

[Lowell]

No using strftime() doesn't make a difference. I've added a few more examples of things I've tried to my question. Seems like "now()" is unknown within the eval-based macro expansion.