Why am I getting "Error in 'SearchParser': The definition of macro is expected to be an eval expression that returns a string."

[herve1]

This is an eval-based macro to be used before the first |
macro definition:
if($Id$=="", " ", " LOGIN_NAME=$Id$ ")
I am using it like this in a splunk search:
... `add_Id(Id=)` | ...
I get this message:
Error in 'SearchParser': The definition of macro 'add_Id(1)' is expected to be an eval expression that returns a string.
What am I doing wrong?

[acharlieh · Accepted solution]

So there are two issues here apparently... First, macro definitions include the argument names, therefore you should be able to invoke it like so:

index=foo `add_Id(*)` | ...

Secondly, playing with it locally, I think you should change your macro definition slightly to make sure the parameter is treated correctly like so. from: if($Id$=="*", " ", " LOGIN_NAME=$Id$ ") to: if("$Id$"=="*", " ", " LOGIN_NAME=$Id$ ")