Splunk Search

Having trouble passing values in a macro to collect command.



I sure hope this is just user error and I am myopic today! 

Have a simple macro:


| addinfo | collect index=$index_parm$ testmode=$testmode_parm$ source=mysource 


These both work:




But these don't work:


|eval index_parm="Indexname"
|eval testmode_parm=0


 When ever I pass a variable I get: 

Error in 'SearchProcessor': Invalid option value. Expecting a 'boolean' for option 'testmode'.  Instead got 'testmode_parm'.

It only complains about the testmode, but it's not passing the index_parm string correctly either.   If I don't pass or remove testmode_parm, I stop getting an error but nothing shows up in the index.  Crtl+Shift+E show index=index_parm.  It's like the substitution is just not taking place.

Any ideas?  Thank you.

Labels (1)
Tags (3)
0 Karma
1 Solution

0 Karma

0 Karma

Ultra Champion

is string or number in this case, I guess.

0 Karma