Having trouble passing values in a macro to collect command.

[ddelmont]

Splunkers,

I sure hope this is just user error and I am myopic today! 

Have a simple macro:

collectevents(2)
args=index_parm,testmode_parm
| addinfo | collect index=$index_parm$ testmode=$testmode_parm$ source=mysource 

These both work:

`collectevents("Indexname",0)`
`collectecents("Indexname","False")`

But these don't work:

stuff....
|eval index_parm="Indexname"
|eval testmode_parm=0
`collectevents(index_parm,testmode_parm)`

 When ever I pass a variable I get: 

Error in 'SearchProcessor': Invalid option value. Expecting a 'boolean' for option 'testmode'.  Instead got 'testmode_parm'.

It only complains about the testmode, but it's not passing the index_parm string correctly either.   If I don't pass or remove testmode_parm, I stop getting an error but nothing shows up in the index.  Crtl+Shift+E show index=index_parm.  It's like the substitution is just not taking place.

Any ideas?  Thank you.

[ddelmont · Accepted solution]

Thank you Murphy.  Should have posted this sooner.  Found a solution at:

https://community.splunk.com/t5/Knowledge-Management/collect-index-quot-based-on-values-quot/td-p/47... 

[to4kawa]

0 is string or number in this case, I guess.