Error in 'eval' command: The expression is malformed. An unexpected character is reached at `\"%Y-%m-%dT%H:%M:%SZ\"), \`

[abhinav_go]

Hello team ,

I am trying to create macro and than use in my splunk dashboard . The purpose is to get time of entered input in dashboard (in only UTC standard) irrespective of user’s time setting in Splunk. 

My macro is :

[strftime_utc(2)]
args = field, format
definition = strftime($field$ - (strptime(strftime($field$, \"%Y-%m-%dT%H:%M:%SZ\"), \"%Y-%m-%dT%H:%M:%S%Z\")-strptime(strftime($field$, \"%Y-%m-%dT%H:%M:%S\"), \"%Y-%m-%dT%H:%M:%S\")), \"$format$\")

 and now my search looks like:

*My query* | eval utc_time=`strftime_utc(_time, "%Y-%m-%dT%H:%M:%SZ")`

So that always get the output in UTC standard only.

But I am getting below error:

 Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\"%Y-%m-%dT%H:%M:%SZ\"), \"%Y-%m-%dT%H:%M:%SZ\") - strptime(strftime(_time, \"%Y-%m-%dT%H:%M:%S\"), \"%Y-%m-%dT%H:%M:%S\")), \"%Y-%m-%dT%H:%M:%SZ\"))'.

How can i resolve ?

Any help is appreciated.

Thanks

[abhinav_go]

Any suggestions by anyone or any query to suggest which I can use to leverage to convert and enforce user's input time to UTC time format only ?

[glc_slash_it]

I believe you don't have to escape the double quotes.

Check the examples in the docs:

https://docs.splunk.com/Documentation/Splunk/9.2.1/admin/macrosconf

[abhinav_go]

Even after removing the escape character , still getting error, now as "Error in 'EvalCommand': The expression is malformed."

Updated query : 

strftime($field$ - (strptime(strftime($field$,"%Y-%m-%dT%H:%M:%SZ"),"%Y-%m-%dT%H:%M:%SZ") - strptime(strftime($field$,"%Y-%m-%dT%H:%M:%S"),"%Y-%m-%dT%H:%M:%S")),"$format$")

Also in "validation expression" while creating macro, i wrote   iseval=1