Splunk Search

Having trouble passing values in a macro to collect command.

Explorer

Splunkers,

I sure hope this is just user error and I am myopic today! 

Have a simple macro:

 

collectevents(2)
args=index_parm,testmode_parm
| addinfo | collect index=$index_parm$ testmode=$testmode_parm$ source=mysource 

 

These both work:

 

`collectevents("Indexname",0)`
`collectecents("Indexname","False")`

 

But these don't work:

 

stuff....
|eval index_parm="Indexname"
|eval testmode_parm=0
`collectevents(index_parm,testmode_parm)`

 

 When ever I pass a variable I get: 

Error in 'SearchProcessor': Invalid option value. Expecting a 'boolean' for option 'testmode'.  Instead got 'testmode_parm'.

It only complains about the testmode, but it's not passing the index_parm string correctly either.   If I don't pass or remove testmode_parm, I stop getting an error but nothing shows up in the index.  Crtl+Shift+E show index=index_parm.  It's like the substitution is just not taking place.

Any ideas?  Thank you.

Labels (1)
Tags (3)
0 Karma
1 Solution

Explorer
0 Karma

Explorer
0 Karma

Ultra Champion

is string or number in this case, I guess.

0 Karma