Hi,
I am in need of an eval macro that takes in three values, examines them and returns the values for three separate fields. I need to return all the three values at once. My macro definition looks like this:
[my_macro(3)]
args = val1,val2,val3
definition = case("$val1$"!="*" AND "$val2$"!="*" AND $val3$=="*","Field1=\"$val1$\" Field2=\"$val2$\" Field3=\"*\"", "$val1$"!="*" AND "$val2$"=="*" AND $val3$!="*","$Field1$=\"$val1$\" Field2=\"*\" Field3=\"$val3$\"", "$val1$"=="*" AND "$val2$"!="*" AND $val3$!="*","$Field1$=\"*\" Field2=\"$val2$\" Field3=\"$val3$\"", "$val1$"=="*" AND "$val2$"=="*" AND $val3$!="*","$Field1$=\"-\" Field2=\"-\" Field3=\"$val3$\"", "$val1$"=="*" AND "$val2$"!="*" AND $val3$=="*","$Field1$=\"-\" Field2=\"$val2$\" Field3=\"-\"", "$val1$"!="*" AND "$val2$"=="*" AND $val3$=="*","$Field1$=\"$val1$\" Field2=\"-\" Field3=\"-\"", "$val1$"=="*" AND "$val2$"=="*" AND $val3$=="*","$Field1$=\"-\" Field2=\"-\" Field3=\"-\"", "$val1$"!="*" AND "$val2$"!="*" AND $val3$!="*","$Field1$=\"$val1$\" Field2=\"$val2$\" Field3=\"$val3$\"")
iseval = 1
When I use this macro in any of my search queries I get the following error:
The definition of macro 'my_macro(3)' is expected to be an eval expression that returns a string.
The values val1, val2 and val3 are obtained from dropdowns in the view
Below is my search query:
index=myIndex earliest=<time> latest=<time> `my_macro($val1$,$val2$,$val3$)` | bucket _time span=span | stats ....
Please let me know where I am going wrong and how I can achieve this.
Thanks
Keerthana
Hello Keerthana,
It's not the macro it's your search which is failing.
index=myIndex earliest=<time> latest=<time> |eval a=`my_macro($val1$,$val2$,$val3$)` | bucket _time span=span | stats ....
if it gives you some error see the inspect link and figure out the error in the replaced search command.
Thanks
I have edited the question to include the search too.
What is the search command are you performing could you post that too?