searchmatch with macro expansion

[klee310]

Hello & merry xmas to all,

I would like to create a macro-expansion using searchmatch (eval-command) such that the argument to searchmatch is expanded from an argument. Here is an example:

[macro1(1)]
definition = | eval YN=if(searchmatch($arg1$),"Y","N")
...

so from Splunk, I might use the macro like this:

... | eval foo="bar&baz&alpha" | eval foo=replace(foo,"&"," AND ") `macro1(foo)`

note, the illustration of foo="bar&baz&alpha" is just an example; in my real usage, the value of foo is retreived from a lookup-table, therefore the number of '&' contained within varies

the error I get is as follows:

Error in 'eval' command: The arguments to the 'searchmatch' function are invalid.

Can this be done?

[martin_mueller · Accepted solution]

Calling a macro like that isn't going to work. Expanding macros is done by string substitution before the search is run. The field foo is computed while the search is run, so that cannot be used by macro expansion.

[klee310]

furthermore, I have tried to simplify the entire problem by moving the searchmatch out of the macro:

... | eval foo="bar&baz&alpha" | eval foo=replace(foo,"&"," AND ") | eval YN=if(searchmatch(foo),"Y","N")

and still I get the same error, and ideas?