Hi, I am trying to use a macro inside a macro validation expression. This is because I plan to make a number of similar macro's which all share some inputs, which need to be validated. However when I run the macro I get the following error: The validation expression is invalid: 'The expression is malformed. An unexpected character is reached at '`names`)... This indicates to me that macro's are not allowed to be used inside validation expressions. Here is a minimum example: Create a macro 'names', which just contains a list of allowed values for a name (e.g. "john", "hank", "pete") Create a macro 'test(1)' that takes one argument, 'name' In the validation expression of 'test', validate the 'name' argument by checking if it occurs in the list: in("$name$", `names`) Now run the 'test' macro in a search, this will give the aforementioned error. I was wondering if this is intended behavior or maybe a bug or wrong setting in my companies Splunk installation? Thanks, Yolan. Edit: I created an Idea to add this functionality, please vote on it if you think it is a good idea, thanks! Allow use of macros in macro validation expressions | Ideas (splunk.com)
... View more
