Splunkers,
I sure hope this is just user error and I am myopic today!
Have a simple macro:
collectevents(2)
args=index_parm,testmode_parm
| addinfo | collect index=$index_parm$ testmode=$testmode_parm$ source=mysource
These both work:
`collectevents("Indexname",0)`
`collectecents("Indexname","False")`
But these don't work:
stuff....
|eval index_parm="Indexname"
|eval testmode_parm=0
`collectevents(index_parm,testmode_parm)`
When ever I pass a variable I get:
Error in 'SearchProcessor': Invalid option value. Expecting a 'boolean' for option 'testmode'. Instead got 'testmode_parm'.
It only complains about the testmode, but it's not passing the index_parm string correctly either. If I don't pass or remove testmode_parm, I stop getting an error but nothing shows up in the index. Crtl+Shift+E show index=index_parm. It's like the substitution is just not taking place.
Any ideas? Thank you.
Thank you Murphy. Should have posted this sooner. Found a solution at:
Thank you Murphy. Should have posted this sooner. Found a solution at:
0 is string or number in this case, I guess.