Splunk Search

eval macro with a case statement errors

RVDowning
Contributor

source="PerfMetrics" "OPEN PLAN" OSArch=64-bit PlanMode=Server |
transaction Guid startswith="OPEN PLAN START" endswith="OPEN PLAN END" |
PlanSize = PlanSize | etc, etc

(It doesn't display in the question, but there are tic marks around the second Plansize above.

with a macro of case(NumRows>0 AND NumRows<=50 AND NumDoors>=650, \"S\", NumRows>=200 AND NumRows<=250 AND NumDoors>=650 , \"M\", NumRows >500, \"L\")

I've tried both with and without escaping the quotes and also having PlanSize = in front of the case as well has having eval Plansize = in front of the case statement. Also, in the calling search I've tried eval PlanSize = PlanSize and just PlanSize

I keep getting:
Error in 'SearchParser': The definition of macro 'PlanSize' is expected to be an eval expression that returns a string.

Don't know any other combinations to try. Can this even be done using macros?

Tags (2)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Guessing the macro will need to start with eval myString = case(NumRows>0 etc.... then after you could have | eval PlanSize = myString because myString will be a value returned from the Macro. I usually like to write the whole search out, make sure it works and then sub in the macro. That way I know the syntax and structure is correct first.

0 Karma

RVDowning
Contributor

Well, guess I don't understand "Eval based expression." Once I unchecked that box it worked fine.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Meet the .conf26 AI Agent Buildathon Winners

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...

Trusted Autonomy in the SOC: A Maturity Journey

AI is compressing attacker timelines and pushing SOC teams beyond human capacity thresholds. The next SOC ...

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...