Splunk Search

How to return string in macro after some logics

madhavanv
New Member

I have following eval based macro to return a string, in the end I am expecting macro to return something like "earliest=08/20/2022:18:39:14 latest=08/20/2022:18:55:14"
so that i can use it in search as follows. 

index=main org_name="cards-org" app_name="service-prod"
`search_range("2022-08-20 19:15:14.104",2)`| table _time msg

But I am getting below error.  Please help to understand what is wrong with this and how to achieve this.

"Error in 'SearchParser': The definition of macro 'search_range(2)' is expected to be an eval expression that returns a string."

Eval based macro definition as follows.

| makeresults
|eval Date="$daterange$"
| eval minutes=$seconds$
| eval formattedEarlyts = strftime((strptime(Date, "%Y-%m-%d %H:%M:%S.%3N") - (minutes * 60)),"%m/%d/%Y:%H:%M:%S")
| eval formattedLatestts = strftime((strptime(Date, "%Y-%m-%d %H:%M:%S.%3N") + (minutes * 60)),"%m/%d/%Y:%H:%M:%S")
| eval timerange= " earliest="+formattedEarlyts+" "+"latest="+formattedLatestts
| fields - Date minutes formattedEarlyts formattedLatestts
| eval case (1==1,timerange)

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

The error is as it says, the macro can only contain an eval expression, not full search commands.  For example, you can put

$a$

in an eval-base macro, or

$a$ + $b$

or

"\"" . strftime((strptime($daterange$, "%Y-%m-%d %H:%M:%S.%3N") - $seconds$ * 60)),"%m/%d/%Y:%H:%M:%S") . "\""

in eval-based macro

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...