Recursive macro invocation fails- Is there a different solution besides defining all possible list values?

[eherbst63]

Hi everyone,

I have the following issue: within a search and a data field I find values like this:

db2_stat = "1,3:8"
db2_stat = "2,5:7"

My issue now is this should be translated into a comma separated list of all values starting with the value on the left side of the colon, ending with the value on the right side. In other words: the resulting data field should look like this:

db2_stat_xlated = "1,3,4,5,6,7,8"
db2_stat_xlated = "2,5,6,7"

I thought, I'd write a macro that calls recursively until the start value reaches end value. But whatever I've tried I ended up with the message 

"Error in 'SearchParser': Reached maximum recursion depth (100) while expanding macros. Check for infinitely recursive macro definitions.".

Last version of the macro code

| eval st_v = $start_v$, ed_v = $end_v$, value_list = $val$
| eval nx_v = st_v + 1
| eval value_list = case(st_v < ed_v, value_list . st_v . "," . `GEN_VALUE_LIST(nx_v, ed_v, value_list)`,

                         st_v == ed_v, value_list . st_v,
                         1==1, value_list)

The macro definition

GEN_VALUE_LIST(3) with these arguments

start_v, end_v, val

Query to test

| makeresults
`GEN_VALUE_LIST(3,6,"1,")`
| table *

Although I'm keen to understand SPLUNK's issue with it (code transferred to perl language works) I'd mostly appreciate a working solution beyond defining all possible list values in a lookup file 🙂

Many thanks in advance,

Ekke

[eherbst63]

Many thx, ITWhisperer, works absolutely fine 🙂

[ITWhisperer · Accepted solution]

| rex field=db2_stat "(?<initial>\d+),(?<start>\d+):(?<end>\d+)"
| eval db2_stat_xlated=initial.",".mvjoin(mvrange(start, end+1),",")