Splunk Search

eval macro with a case statement errors

RVDowning
Contributor

source="PerfMetrics" "OPEN PLAN" OSArch=64-bit PlanMode=Server |
transaction Guid startswith="OPEN PLAN START" endswith="OPEN PLAN END" |
PlanSize = PlanSize | etc, etc

(It doesn't display in the question, but there are tic marks around the second Plansize above.

with a macro of case(NumRows>0 AND NumRows<=50 AND NumDoors>=650, \"S\", NumRows>=200 AND NumRows<=250 AND NumDoors>=650 , \"M\", NumRows >500, \"L\")

I've tried both with and without escaping the quotes and also having PlanSize = in front of the case as well has having eval Plansize = in front of the case statement. Also, in the calling search I've tried eval PlanSize = PlanSize and just PlanSize

I keep getting:
Error in 'SearchParser': The definition of macro 'PlanSize' is expected to be an eval expression that returns a string.

Don't know any other combinations to try. Can this even be done using macros?

Tags (2)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Guessing the macro will need to start with eval myString = case(NumRows>0 etc.... then after you could have | eval PlanSize = myString because myString will be a value returned from the Macro. I usually like to write the whole search out, make sure it works and then sub in the macro. That way I know the syntax and structure is correct first.

0 Karma

RVDowning
Contributor

Well, guess I don't understand "Eval based expression." Once I unchecked that box it worked fine.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...