Splunk Search

eval macro with a case statement errors

RVDowning
Contributor

source="PerfMetrics" "OPEN PLAN" OSArch=64-bit PlanMode=Server |
transaction Guid startswith="OPEN PLAN START" endswith="OPEN PLAN END" |
PlanSize = PlanSize | etc, etc

(It doesn't display in the question, but there are tic marks around the second Plansize above.

with a macro of case(NumRows>0 AND NumRows<=50 AND NumDoors>=650, \"S\", NumRows>=200 AND NumRows<=250 AND NumDoors>=650 , \"M\", NumRows >500, \"L\")

I've tried both with and without escaping the quotes and also having PlanSize = in front of the case as well has having eval Plansize = in front of the case statement. Also, in the calling search I've tried eval PlanSize = PlanSize and just PlanSize

I keep getting:
Error in 'SearchParser': The definition of macro 'PlanSize' is expected to be an eval expression that returns a string.

Don't know any other combinations to try. Can this even be done using macros?

Tags (2)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Guessing the macro will need to start with eval myString = case(NumRows>0 etc.... then after you could have | eval PlanSize = myString because myString will be a value returned from the Macro. I usually like to write the whole search out, make sure it works and then sub in the macro. That way I know the syntax and structure is correct first.

0 Karma

RVDowning
Contributor

Well, guess I don't understand "Eval based expression." Once I unchecked that box it worked fine.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Mastering Threat Intelligence in ES 8.5, Splunk AI Assistant v2, and More from Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...