Splunk Search

Eval macro with string argument

MatMeredith
Path Finder

I'm trying to define a Splunk eval based macro that takes a string as a parameter (where the string must be able to contain spaces), tests the value of the string, and then returns a value based on the outcome of that test. But I can't get it to work. Taking as a simplified example...

Macro definition:

if ($arg1$=="Test String", "true", "false")

Macro invocation:

`name("Test String")`

The macro always evaluates to false. I've tried every combination of single and double quotes that I can think of in both the macro definition and invocation, but I can't seem to get this to work. Am I missing something?

Thanks!

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Define your macro as follows:

if("$arg1$"=="test","true","false") 

The quotes around $arg1$ are necessary. Then the value placed into the macro content by string substitution again gets treated as a string rather than as a reference to a field.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Define your macro as follows:

if("$arg1$"=="test","true","false") 

The quotes around $arg1$ are necessary. Then the value placed into the macro content by string substitution again gets treated as a string rather than as a reference to a field.

MatMeredith
Path Finder

Perfect -- thank you Martin.

0 Karma

linu1988
Champion

Hello Martin,
both the scenario works for me, just had to tweak the passing of arguments.

0 Karma

linu1988
Champion

Hello Mat,
please write the macro definiton as:

" if ($arg1$=="Test String", "true", "false")

and call the eval statement as "eval a=`macro_name((Backslash)\"Test String(Backslash)\")" as double quote will give you error

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...