Eval macro with string argument

[MatMeredith]

I'm trying to define a Splunk eval based macro that takes a string as a parameter (where the string must be able to contain spaces), tests the value of the string, and then returns a value based on the outcome of that test. But I can't get it to work. Taking as a simplified example...

Macro definition:

if ($arg1$=="Test String", "true", "false")

Macro invocation:

`name("Test String")`

The macro always evaluates to false. I've tried every combination of single and double quotes that I can think of in both the macro definition and invocation, but I can't seem to get this to work. Am I missing something?

Thanks!

[martin_mueller · Accepted solution]

Define your macro as follows:

if("$arg1$"=="test","true","false") 

The quotes around $arg1$ are necessary. Then the value placed into the macro content by string substitution again gets treated as a string rather than as a reference to a field.

[MatMeredith]

Perfect -- thank you Martin.

[linu1988]

Hello Martin,
both the scenario works for me, just had to tweak the passing of arguments.

[linu1988]

Hello Mat,
please write the macro definiton as:

" if ($arg1$=="Test String", "true", "false")

and call the eval statement as "eval a=`macro_name((Backslash)\"Test String(Backslash)\")" as double quote will give you error