Splunk Search

eval macro with a case statement errors

RVDowning
Contributor

source="PerfMetrics" "OPEN PLAN" OSArch=64-bit PlanMode=Server |
transaction Guid startswith="OPEN PLAN START" endswith="OPEN PLAN END" |
PlanSize = PlanSize | etc, etc

(It doesn't display in the question, but there are tic marks around the second Plansize above.

with a macro of case(NumRows>0 AND NumRows<=50 AND NumDoors>=650, \"S\", NumRows>=200 AND NumRows<=250 AND NumDoors>=650 , \"M\", NumRows >500, \"L\")

I've tried both with and without escaping the quotes and also having PlanSize = in front of the case as well has having eval Plansize = in front of the case statement. Also, in the calling search I've tried eval PlanSize = PlanSize and just PlanSize

I keep getting:
Error in 'SearchParser': The definition of macro 'PlanSize' is expected to be an eval expression that returns a string.

Don't know any other combinations to try. Can this even be done using macros?

Tags (2)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Guessing the macro will need to start with eval myString = case(NumRows>0 etc.... then after you could have | eval PlanSize = myString because myString will be a value returned from the Macro. I usually like to write the whole search out, make sure it works and then sub in the macro. That way I know the syntax and structure is correct first.

0 Karma

RVDowning
Contributor

Well, guess I don't understand "Eval based expression." Once I unchecked that box it worked fine.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...