Knowledge Management

How to escape "(" in macro arguments?

RohiniJindam
Path Finder

I pass values with parentheses to my macro. Need to escape the round brackets.

The following error was thrown:

PARSER: Applying intentions failed Error in 'SearchParser': Error for macro argument expression Arguments that start with '(' must end with ')'.

Seems replace allows only strings to used as a replace expression

Any suggestion welcome. Thanks

Tags (2)
0 Karma

landen99_gdms
Engager

`macro1("my_parent()")` works because the parenthesis is inside of the double quotes.

`macro1(my_paren())` does not work because there is no double quotes around it.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Passing arguments with parentheses to macros should work well, here's a tiny example:

I've defined a macro echo(1) with the argument arg as follows:

"$arg$"

Using that, I've created a search like this:

| stats count | eval test = `echo("(Unauthenticated)177.177.9.9")`

That produces one event with a field test that contains the string (Unauthenticated)177.177.9.9, no error messages.

If you keep getting errors, post both your macro definition and the search you're trying to run.

0 Karma

linu1988
Champion

Then it's the problem with the macro definition. it should give you the User_Name when you pass it in the search.

0 Karma

linu1988
Champion

Does the macro give you the result when applied with some static value? And what macro does is just replace the value of the variable. When you pass like "$userid$", then in macro it becomes ""$userid$"", isn't it? and while converting the macro in XML it also makes it " , which is not supported by xml, need to replace it by " in definition.

0 Karma

linu1988
Champion

web("$userid$") , why do we need double quotes? Could you post the macro definition?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I see - I used a non-eval-based macro, they behave differently in some ways... I'll take a look at those later, if noone else has a solution by then.

martin_mueller
SplunkTrust
SplunkTrust

In my macro definition I did not escape the quotes - does that change anything for you?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Did you put quotes around it in the macro definition?

0 Karma

RohiniJindam
Path Finder

Thank you for your response

replace(X, Y, Z)

I'm not sure if the Z argument can be anything other than string

0 Karma

linu1988
Champion

replace does allow regex, please test it on the search app, i think there is a problem with xml.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...