I have following eval based macro to return a string, in the end I am expecting macro to return something like "earliest=08/20/2022:18:39:14 latest=08/20/2022:18:55:14"
so that i can use it in search as follows.
index=main org_name="cards-org" app_name="service-prod"
`search_range("2022-08-20 19:15:14.104",2)`| table _time msg
But I am getting below error. Please help to understand what is wrong with this and how to achieve this.
"Error in 'SearchParser': The definition of macro 'search_range(2)' is expected to be an eval expression that returns a string."
Eval based macro definition as follows.
| makeresults
|eval Date="$daterange$"
| eval minutes=$seconds$
| eval formattedEarlyts = strftime((strptime(Date, "%Y-%m-%d %H:%M:%S.%3N") - (minutes * 60)),"%m/%d/%Y:%H:%M:%S")
| eval formattedLatestts = strftime((strptime(Date, "%Y-%m-%d %H:%M:%S.%3N") + (minutes * 60)),"%m/%d/%Y:%H:%M:%S")
| eval timerange= " earliest="+formattedEarlyts+" "+"latest="+formattedLatestts
| fields - Date minutes formattedEarlyts formattedLatestts
| eval case (1==1,timerange)
The error is as it says, the macro can only contain an eval expression, not full search commands. For example, you can put
$a$
in an eval-base macro, or
$a$ + $b$
or
"\"" . strftime((strptime($daterange$, "%Y-%m-%d %H:%M:%S.%3N") - $seconds$ * 60)),"%m/%d/%Y:%H:%M:%S") . "\""
in eval-based macro