I followed steps similar to isnum() validation to be applied on macro input argument defined on http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchmacroexamples. However, I always get Validation error, even if the macro argument value is numeric. Following macro Definition: #Working macro with one argument. Validation or Error Message [format_bytes_validation_error(1)] args = bytes definition = eval $bytes$=case($bytes$>=1125899906842624 AND $bytes$>1152921504606846976, tostring(round($bytes$/1152921504606846976,2))+" ZB",$bytes$>=1099511627776 AND committed<1125899906842624,tostring(round($bytes$/1073741824,2))+" TB",$bytes$>=1073741824 AND $bytes$<1099511627776, tostring(round($bytes$/1073741824,2))+" GB", $bytes$>=1048576 AND $bytes$<1073741824, tostring(round($bytes$/1048576,2))+" MB", $bytes$>1024 AND $bytes$<1073741824, tostring(round($bytes$/1024,2))+" KB", $bytes$<1024,tostring($bytes$+" Bytes"),1=1,tostring(round($bytes$/1152921504606846976,2))+" ZB") errormsg = "Argument must be numeric" iseval = 0 validation = isnum($bytes$) And following is the SPL to test | makeresults | eval size=10221212 | eval fieldType=if(isnum(size),"Numeric","NonNumeric") | table size, fieldType | `format_bytes_validation_error(size)` I also referred to the example in Splunk Document for macros.conf (http://docs.splunk.com/Documentation/Splunk/latest/Admin/Macrosconf) file, it mentions Validation section with Argument/s without dollar prefix and suffix i.e. validation = foo > bar. I tried something similar with my macro argument as well and still did not work. PS: the macro works fine without any validation. ... View more

Please provide working example of iseval=true or iseval=1 as that also did not work as described in Splunk docs (http://docs.splunk.com/Documentation/Splunk/latest/Admin/Macrosconf) or in macros.conf. Here is what I tries for iseval=true. I just removed eval $bytes$= from definition which was working fine for me without iseval. #Macro with one argument. iseval true and no Validation or Error Message [format_bytes_eval_true(1)] args = bytes definition = case($bytes$>=1125899906842624 AND $bytes$>1152921504606846976, tostring(round($bytes$/1152921504606846976,2))+" ZB",$bytes$>=1099511627776 AND committed<1125899906842624,tostring(round($bytes$/1073741824,2))+" TB",$bytes$>=1073741824 AND $bytes$<1099511627776, tostring(round($bytes$/1073741824,2))+" GB", $bytes$>=1048576 AND $bytes$<1073741824, tostring(round($bytes$/1048576,2))+" MB", $bytes$>1024 AND $bytes$<1073741824, tostring(round($bytes$/1024,2))+" KB", $bytes$<1024,tostring($bytes$+" Bytes"),1=1,tostring(round($bytes$/1152921504606846976,2))+" ZB") errormsg = iseval = true validation = PS: I tried on Splunk Enterprise 6.5 ... View more