Splunk Search

Having trouble passing values in a macro to collect command.



I sure hope this is just user error and I am myopic today! 

Have a simple macro:


| addinfo | collect index=$index_parm$ testmode=$testmode_parm$ source=mysource 


These both work:




But these don't work:


|eval index_parm="Indexname"
|eval testmode_parm=0


 When ever I pass a variable I get: 

Error in 'SearchProcessor': Invalid option value. Expecting a 'boolean' for option 'testmode'.  Instead got 'testmode_parm'.

It only complains about the testmode, but it's not passing the index_parm string correctly either.   If I don't pass or remove testmode_parm, I stop getting an error but nothing shows up in the index.  Crtl+Shift+E show index=index_parm.  It's like the substitution is just not taking place.

Any ideas?  Thank you.

Labels (1)
Tags (3)
0 Karma
1 Solution

0 Karma

0 Karma

Ultra Champion

is string or number in this case, I guess.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!