How to call macros from a Splunk JavaScript SDK search?

[ektasiwani]

Hi,

In my search, I need to call a macro with the eval command, but I am getting error "bad request".
My macros.conf file is inside an app and I have given that app global permission.

[calc_score]
definition = case( $score$=40,"pass", $score$=70,"average", $score$=90,"good")
args = score

I am trying to call this macro using JavaScript SDK search:

.. |  eval Severity=`calc_score(score=fieldname)`

I tried adding search before macro name, but no use, something like this :

.. |  eval Severity=search `calc_score(score=fieldname)

Is this the wrong way to call macros using the JavaScript SDK?

Any help is appreciated.

Thanks

[ektasiwani · Accepted solution]

Hi ,

I found solution.

I gave global permission to macros.conf file separately in "metadata/local.meta" and replaced:

 .. |  eval Severity= 'calc_score(score=fieldname)'  

with

.. |  eval Severity=`calc_score(score=fieldname)` 

and it started working.

Hope this helps others.

[ektasiwani]

Hi aljohnson ,

Yes search works fine without macro.

[aljohnson_splun]

Can you verify the search works w/o the macro?