Getting Data In

Multiline macro writing format problem

crazyeva
Contributor

*emphasized text*i was defining a macro search
writing the search each pipe in one line like:
xxxx
|aaa
|bbb
|ccc
it failed to work.
but when i put them all in one line: xxxx|aaa|bbb|ccc, it worked
the error information was:
"Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression"
i tried to locate the problem, maybe a subsearch caused this error:
xxxx
|eval [search xxx
|return i]
|xxxx
which writing in one line will result as "xxxx|eval i=something|xxxx"
but "i" was not actually returned in multi-line mode.
is that bug? or macro search is not suggested to multiline way?

Tags (2)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

There is a bug in the macro when it is saved in the config file, unable to handle the linebreak char after a function. Go oneliner or finish the line with a pipe.

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

There is a bug in the macro when it is saved in the config file, unable to handle the linebreak char after a function. Go oneliner or finish the line with a pipe.

0 Karma

yannK
Splunk Employee
Splunk Employee

This is planned to be fixed in next patch version (likely 6.0.1 and 5.0.6). See SPL-72399 in the changelog once released for details.

0 Karma

phoenixdigital
Builder

Is this bug ever going to be fixed?

I have some very complex macros that are much easier to read and edit when they are split over multiple lines?

Edit: I tried the finish each line with a pipe but that didnt seem to work.

0 Karma

crazyeva
Contributor

Thank you.

0 Karma

crazyeva
Contributor

by the way, "xxx|bucket _time span=30m|xxx" works well in oneline, but goes wrong in multi lines, unless change it a little: "xxx|bucket span=30m _time|xxx"

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...