I'm trying to define a Splunk eval based macro that takes a string as a parameter (where the string must be able to contain spaces), tests the value of the string, and then returns a value based on the outcome of that test. But I can't get it to work. Taking as a simplified example...
Macro definition:
if ($arg1$=="Test String", "true", "false")
Macro invocation:
`name("Test String")`
The macro always evaluates to false. I've tried every combination of single and double quotes that I can think of in both the macro definition and invocation, but I can't seem to get this to work. Am I missing something?
Thanks!
Define your macro as follows:
if("$arg1$"=="test","true","false")
The quotes around $arg1$ are necessary. Then the value placed into the macro content by string substitution again gets treated as a string rather than as a reference to a field.
Define your macro as follows:
if("$arg1$"=="test","true","false")
The quotes around $arg1$ are necessary. Then the value placed into the macro content by string substitution again gets treated as a string rather than as a reference to a field.
Perfect -- thank you Martin.
Hello Martin,
both the scenario works for me, just had to tweak the passing of arguments.
Hello Mat,
please write the macro definiton as:
" if ($arg1$=="Test String", "true", "false")
and call the eval statement as "eval a=`macro_name((Backslash)\"Test String(Backslash)\")" as double quote will give you error