I have following eval based macro to return a string, in the end I am expecting macro to return something like "earliest=08/20/2022:18:39:14 latest=08/20/2022:18:55:14" so that i can use it in search as follows. index=main org_name="cards-org" app_name="service-prod" `search_range("2022-08-20 19:15:14.104",2)`| table _time msg But I am getting below error. Please help to understand what is wrong with this and how to achieve this. "Error in 'SearchParser': The definition of macro 'search_range(2)' is expected to be an eval expression that returns a string." Eval based macro definition as follows. | makeresults |eval Date="$daterange$" | eval minutes=$seconds$ | eval formattedEarlyts = strftime((strptime(Date, "%Y-%m-%d %H:%M:%S.%3N") - (minutes * 60)),"%m/%d/%Y:%H:%M:%S") | eval formattedLatestts = strftime((strptime(Date, "%Y-%m-%d %H:%M:%S.%3N") + (minutes * 60)),"%m/%d/%Y:%H:%M:%S") | eval timerange= " earliest="+formattedEarlyts+" "+"latest="+formattedLatestts | fields - Date minutes formattedEarlyts formattedLatestts | eval case (1==1,timerange)
... View more