In version 1.6, there is a very poor 'you're screwing up' error message.
in 1.4 you use
| `ut_parse(trimurl)`
in 1.6 you use
| eval ut_list = "iana"
| `ut_parse(urllist, ut_list)`
If you don't use this ut_list, you get a cryptic error message:
Error in 'SearchParser': The search specifies a macro 'ut_parse' that cannot be found...
Anyway to make this error a little clearer? I'm guessing this is a core Splunk issue with how they present the error, but just checking.
↧