Knowledge Management

Macro with eval-based definition submacro to set earliest and latest

JensT
Communicator

Hello,

i need a macro that acceppts a day and converts that into a format to it can be used in earliest and latest inside.
My idea:

createReport(1)
param: 'day', format='yyyy-MM-dd'
search=foo bar error NOT warning earliest=parseDayForEarliest($day$) latest=parseDayForLatest($day$)

parseDayForEarliest(1)
param: 'day', format='yyyy-MM-dd'
strftime(strptime($day$,"%Y-%M-%d")-86400,"%m/%d/%Y:%H:%M:%S")

parseDayForLatest(1)
param: 'day', format='yyyy-MM-dd'
strftime(strptime($day$,"%Y-%M-%d"),"%m/%d/%Y:%H:%M:%S")

But it does not work 😞

Regards, Jens

Tags (2)
0 Karma

JensT
Communicator

Martin: It was that simple. I just was missing the quotes in the submacro.

In the main macro:
earliest=parseDayForEarliest("2013-03-13")

parseDayForEarliest(1)
strftime(strptime("$day$","%Y-%m-%d"),"%m/%d/%Y:%H:%M:%S")
eval-based defintion on.

Regards, Jens

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

First of all, %M is minute - you need %m for month.

That's not the main problem though... you cannot write earliest=some_function(...). You need to move that to a subsearch like this:

[stats count | eval earliest=relative_time(strptime("$day$","%Y-%m-%d"), "-d") | return earliest] [stats count | eval latest=strptime("$day$","%Y-%m-%d") | return latest]

Those subsearches can now be moved into a macro.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Don't blame strptime for that, just enclose $day$ in quotes. Else you end up computing 2013-03-27 as 1983.

0 Karma

JensT
Communicator

Hi,

thanks for the answer and the correction for the strptime.

Your solution might work, but I disagree that i need to do it like this.
eval-based-defintion macros can be used here. Its just that i have problems to return the output as string. Tests are working fine with simple things, but not with strptime.

Regards, Jens

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...