https://community.splunk.com/t5/Getting-Data-In/Variable-string-processing-in-variable-string-in-map-command/m-p/527735#M88995 <P>All searches should specify an index for better performance.&nbsp; Those searches that do not specify an index will search the role's default index(es), which may not include the desired index.&nbsp; If your role does not include "_internal" as a default index then searching "$c$" will return nothing if "$c$" only exists in the internal index.</P> Tue, 03 Nov 2020 14:17:21 GMT richgalloway 2020-11-03T14:17:21Z https://community.splunk.com/t5/Getting-Data-In/Variable-string-processing-in-variable-string-in-map-command/m-p/527662#M88989 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="litmuspaper_0-1604391270333.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/11620iC7C2A54CCAC21A90/image-size/medium?v=v2&amp;px=400" role="button" title="litmuspaper_0-1604391270333.png" alt="litmuspaper_0-1604391270333.png" /></span></P><P>IF the _raw is the same as above, I want to search with the query below.</P><P>Index=_internal sourcetype=splunkd</P><P>&nbsp;</P><P><SPAN>I want to use the map command with the contents of the C column. Without putting A and B columns in the map command</SPAN></P><P><SPAN>NO&nbsp; -&gt;&gt;&nbsp; | map search="search earliest=-1d@d latest=now index=$a$ sourcetype=$b$"</SPAN></P><P>&nbsp;</P><P><SPAN>I used this SPL, but it did not produce the desired result.</SPAN></P><P><SPAN>| map search="search earliest=-1d@d latest=now $c$"</SPAN></P><P><SPAN>I guess this query seems to mean this.</SPAN></P><P><SPAN>search earliest=-1d@d latest=now index=$a$ sourcetype=$b$</SPAN></P><P>&nbsp;</P><P><SPAN>Help, Variable string processing in variable string in map command. Please</SPAN></P> Tue, 03 Nov 2020 08:32:04 GMT https://community.splunk.com/t5/Getting-Data-In/Variable-string-processing-in-variable-string-in-map-command/m-p/527662#M88989 litmuspaper 2020-11-03T08:32:04Z https://community.splunk.com/t5/Getting-Data-In/Variable-string-processing-in-variable-string-in-map-command/m-p/527735#M88995 <P>All searches should specify an index for better performance.&nbsp; Those searches that do not specify an index will search the role's default index(es), which may not include the desired index.&nbsp; If your role does not include "_internal" as a default index then searching "$c$" will return nothing if "$c$" only exists in the internal index.</P> Tue, 03 Nov 2020 14:17:21 GMT https://community.splunk.com/t5/Getting-Data-In/Variable-string-processing-in-variable-string-in-map-command/m-p/527735#M88995 richgalloway 2020-11-03T14:17:21Z