Knowledge Management

Why is my macro returning error "expected to be an eval expression that returns a string." with my current definition?

rgcox1
Communicator

Tried many variations (enclosing arg in quotes, $, and backslash) and got many errors - mostly "expected to be an eval expression that returns a string."
Definition:

[PACTime(1)]
eval PacTime=strftime(relative_time($etime$,"-8h"),"%m/%d/%y %H:%M:%S")

Called as

EventID=6* | eval dtime=`PACTime(_time)`| table Host, dtime

Seems like this would be eval based, but tried both ways.
Any help appreciated.

Tags (1)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

When you substitute your macro back into the search, it looks like this -

EventID=6* | eval dtime=eval PacTime=strftime(relative_time(_time,"-8h"),"%m/%d/%y %H:%M:%S")| table Host, dtime

Seems like you have a double-eval in there.

Your macro is coded as if it were a function to return a value by assigning that value to the macro's name. That's not what macros actually do - they expand from their pattern and return a chunk of code for the search. This macro, as coded, is creating an unnecessary new field Pactime.

jdunlea's answer, which uses that field, is correct. however, there is a simpler solution. If you streamline the macro to just

strftime(relative_time($etime$,"-8h"),"%m/%d/%y %H:%M:%S")

then it should work fine without creating that unneeded field.

0 Karma

ppablo
Retired

HI @rgcox1

Just following up with this post, but did @jdunlea's answer below help solve your question? If yes, please confirm and accept the answer. If you found another answer that worked, please share. Thanks!

0 Karma

jdunlea
Contributor

My guess is that it doesnt like the back ticks which are required for the macro. I would just set up the macro to run initially, bringing back the field "PacTime" and then eval "dtime" and set it to be the same as "PacTime".

EG: ... | PACTime(_time) | eval dtime=PacTime | ...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...