Splunk Search

Why am I getting "Error in 'SearchParser': The definition of macro is expected to be an eval expression that returns a string."

herve1
Engager

This is an eval-based macro to be used before the first |
macro definition:
if($Id$=="", " ", " LOGIN_NAME=$Id$ ")
I am using it like this in a splunk search:
... `add_Id(Id=
)` | ...
I get this message:
Error in 'SearchParser': The definition of macro 'add_Id(1)' is expected to be an eval expression that returns a string.
What am I doing wrong?

Tags (1)
0 Karma
1 Solution

acharlieh
Influencer

So there are two issues here apparently... First, macro definitions include the argument names, therefore you should be able to invoke it like so:

index=foo `add_Id(*)` | ...

Secondly, playing with it locally, I think you should change your macro definition slightly to make sure the parameter is treated correctly like so. from: if($Id$=="*", " ", " LOGIN_NAME=$Id$ ") to: if("$Id$"=="*", " ", " LOGIN_NAME=$Id$ ")

View solution in original post

0 Karma

acharlieh
Influencer

So there are two issues here apparently... First, macro definitions include the argument names, therefore you should be able to invoke it like so:

index=foo `add_Id(*)` | ...

Secondly, playing with it locally, I think you should change your macro definition slightly to make sure the parameter is treated correctly like so. from: if($Id$=="*", " ", " LOGIN_NAME=$Id$ ") to: if("$Id$"=="*", " ", " LOGIN_NAME=$Id$ ")

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...