So if I read these correctly you can't pass a token to a subsearch: https://community.splunk.com/t5/Splunk-Search/Pass-value-to-subsearch-with-inputlookup/td-p/494990 https://community.splunk.com/t5/Splunk-Search/How-to-expand-macro-arguments-in-eval-subsearch/m-p/135456  Ok, So instead of a subsearch with inputlookup, I am trying to pass a token to |ookup.  Not working either... LOL. So macro set with iseval is now: | lookup test_lookup.csv local=true c1 as $row$ | format | eval search="\"".search."\"" Running: | makeresults | eval row="r3" | eval string=`test_macro(row)` returns: Error in 'SearchParser': The definition of macro 'test_macro(1)' is expected to be an eval expression that returns a string. So what am I missing.  I'm running version 7.3.7.1, is that why it doesn't work? I've also read (below) and seems like this should work. https://community.splunk.com/t5/Splunk-Search/When-I-use-eval-command-to-assign-search-to-variable-why-does-it/m-p/307284  https://community.splunk.com/t5/Splunk-Search/Don-t-get-eval-based-macros/m-p/32007#M6652  ... View more

So it's only possible to use a variable before the output and not after?  Anyway around this?  Thanks. ... View more

I have the same issue.  I have the plugin install, but it doesn't support the additional_info field they are asking me to populate. I found the json_object and json_array commands that look like they will work to create the json blob.  I still need to figure out how to make the API call to send the data over. I'll post again if I figure that part out. ... View more