I pass values with parentheses to my macro. Need to escape the round brackets.
The following error was thrown:
PARSER: Applying intentions failed Error in 'SearchParser': Error for macro argument expression Arguments that start with '(' must end with ')'.
Seems replace
allows only strings to used as a replace expression
Any suggestion welcome. Thanks
`macro1("my_parent()")` works because the parenthesis is inside of the double quotes.
`macro1(my_paren())` does not work because there is no double quotes around it.
Passing arguments with parentheses to macros should work well, here's a tiny example:
I've defined a macro echo(1)
with the argument arg
as follows:
"$arg$"
Using that, I've created a search like this:
| stats count | eval test = `echo("(Unauthenticated)177.177.9.9")`
That produces one event with a field test
that contains the string (Unauthenticated)177.177.9.9
, no error messages.
If you keep getting errors, post both your macro definition and the search you're trying to run.
Then it's the problem with the macro definition. it should give you the User_Name when you pass it in the search.
Does the macro give you the result when applied with some static value? And what macro does is just replace the value of the variable. When you pass like "$userid$", then in macro it becomes ""$userid$"", isn't it? and while converting the macro in XML it also makes it " , which is not supported by xml, need to replace it by " in definition.
web("$userid$")
, why do we need double quotes? Could you post the macro definition?
I see - I used a non-eval-based macro, they behave differently in some ways... I'll take a look at those later, if noone else has a solution by then.
In my macro definition I did not escape the quotes - does that change anything for you?
Did you put quotes around it in the macro definition?
Thank you for your response
replace(X, Y, Z)
I'm not sure if the Z
argument can be anything other than string
replace does allow regex, please test it on the search app, i think there is a problem with xml.