Hi,
I am trying to use a macro inside a macro validation expression. This is because I plan to make a number of similar macro's which all share some inputs, which need to be validated.
However when I run the macro I get the following error:
The validation expression is invalid: 'The expression is malformed. An unexpected character is reached at '`names`)...
This indicates to me that macro's are not allowed to be used inside validation expressions.
Here is a minimum example:
- Create a macro 'names', which just contains a list of allowed values for a name (e.g. "john", "hank", "pete")
- Create a macro 'test(1)' that takes one argument, 'name'
- In the validation expression of 'test', validate the 'name' argument by checking if it occurs in the list:
in("$name$", `names`)
- Now run the 'test' macro in a search, this will give the aforementioned error.
I was wondering if this is intended behavior or maybe a bug or wrong setting in my companies Splunk installation?
Thanks, Yolan.
Edit: I created an Idea to add this functionality, please vote on it if you think it is a good idea, thanks! Allow use of macros in macro validation expressions | Ideas (splunk.com)
