Splunk Search

stats. eval and search macros?

Contributor

I am using a search macro in an eval and it returns all zeros. But, when I expand it, it functions as expected. Is that normal?

ie:

 `get_all_email` | stats count(eval(`receive_event`)) as Sent by recipientlist

This returns all zeros.

`get_all_email` | stats count(eval(((event_id="DELIVER" AND source_id="STOREDRIVER") OR (event_id=1023)))) as Sent by recipientlist

This works perfectly.

Tags (2)
0 Karma
1 Solution

Contributor

Interesting. I think there was something wrong with the macros.conf file. I opened it to paste the contents, and it looked like this:

[receive_event]
definition = ( (event_id="DELIVER" AND source_id="STOREDRIVER") OR\
(event_id=1023) )\

iseval = 0

My other eval/macro was working that looked like this:

[send_event]
definition = ( (event_id="TRANSFER" AND source_id="ROUTING") OR (event_id=1033) )
iseval = 0

So, I modified the receive_event manually to look like this:

[receive_event]
definition = ( (event_id="DELIVER" AND source_id="STOREDRIVER") OR (event_id=1023) )
iseval = 0

And now it seems to be working.

View solution in original post

Contributor

Interesting. I think there was something wrong with the macros.conf file. I opened it to paste the contents, and it looked like this:

[receive_event]
definition = ( (event_id="DELIVER" AND source_id="STOREDRIVER") OR\
(event_id=1023) )\

iseval = 0

My other eval/macro was working that looked like this:

[send_event]
definition = ( (event_id="TRANSFER" AND source_id="ROUTING") OR (event_id=1033) )
iseval = 0

So, I modified the receive_event manually to look like this:

[receive_event]
definition = ( (event_id="DELIVER" AND source_id="STOREDRIVER") OR (event_id=1023) )
iseval = 0

And now it seems to be working.

View solution in original post

Splunk Employee
Splunk Employee

that looks like a bug in the UI putting linebreaks into the macro.

0 Karma

Splunk Employee
Splunk Employee

it would be helpful to see your macro definition/macros.conf file.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!