Issue in returning space from eval macro

[keerthana_k]

Hi,

I am in need of an eval macro that takes in three values, examines them and returns the values for three separate fields. I need to return all the three values at once. My macro definition looks like this:

[my_macro(3)]
args = val1,val2,val3
definition = case("$val1$"!="*" AND "$val2$"!="*" AND $val3$=="*","Field1=\"$val1$\" Field2=\"$val2$\" Field3=\"*\"", "$val1$"!="*" AND "$val2$"=="*" AND $val3$!="*","$Field1$=\"$val1$\" Field2=\"*\" Field3=\"$val3$\"", "$val1$"=="*" AND "$val2$"!="*" AND $val3$!="*","$Field1$=\"*\" Field2=\"$val2$\" Field3=\"$val3$\"", "$val1$"=="*" AND "$val2$"=="*" AND $val3$!="*","$Field1$=\"-\" Field2=\"-\" Field3=\"$val3$\"", "$val1$"=="*" AND "$val2$"!="*" AND $val3$=="*","$Field1$=\"-\" Field2=\"$val2$\" Field3=\"-\"", "$val1$"!="*" AND "$val2$"=="*" AND $val3$=="*","$Field1$=\"$val1$\" Field2=\"-\" Field3=\"-\"", "$val1$"=="*" AND "$val2$"=="*" AND $val3$=="*","$Field1$=\"-\" Field2=\"-\" Field3=\"-\"", "$val1$"!="*" AND "$val2$"!="*" AND $val3$!="*","$Field1$=\"$val1$\" Field2=\"$val2$\" Field3=\"$val3$\"")
iseval = 1

When I use this macro in any of my search queries I get the following error:

The definition of macro 'my_macro(3)' is expected to be an eval expression that returns a string.

The values val1, val2 and val3 are obtained from dropdowns in the view

Below is my search query:

index=myIndex earliest=<time> latest=<time> `my_macro($val1$,$val2$,$val3$)` | bucket _time span=span | stats ....

Please let me know where I am going wrong and how I can achieve this.

Thanks

Keerthana

[linu1988]

Hello Keerthana,
It's not the macro it's your search which is failing.

index=myIndex earliest=<time> latest=<time> |eval a=`my_macro($val1$,$val2$,$val3$)` | bucket _time span=span | stats ....

if it gives you some error see the inspect link and figure out the error in the replaced search command.

Thanks

[keerthana_k]

I have edited the question to include the search too.

[linu1988]

What is the search command are you performing could you post that too?