Error in 'SearchParser': Missing a search command before '''. Error at position '264' of search query

[qhmassc]

I configured a Macro name securemsg(1), I use this Marco in the following search:

....| eval log_info=_raw | 'securemsg(log_info)' | ....

When I run this search I got following error:

Error in 'SearchParser': Missing a search command before '''. Error at position '264' of search query 'search index="linuxos" sourcetype="syslog" host="C...{snipped} {errorcontext = fo=_raw | 'securemsg(}'.

Please help.

Thanks

[qhmassc]

I changed to  ....| eval log_info=_raw | "securemsg(log_info)" | ..., but got the same error

how to use  <ctrl><shift>E to expand the macro?

Thanks

[ITWhisperer · Accepted solution]

You have now used double quotes - try back quotes

`

Put your cursor in the search window and press <ctrl><shift>E keys together

[qhmassc]

Thanks, You are right!  Need to use back quotes

[ITWhisperer]

It looks like you are using single quotes around the macro rather than backquotes

Are you sure the macro expands correctly - try using <ctrl><shift>E to expand the macro