<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Map with inputlookup not working in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Map-with-inputlookup-not-working/m-p/333052#M93438</link>
    <description>&lt;P&gt;The &lt;CODE&gt;map&lt;/CODE&gt; command will, by default, only take the first ten values. If you'd like it to look at more than ten, you need to use the &lt;CODE&gt;maxsearches&lt;/CODE&gt; flag, like: &lt;CODE&gt;| map maxsearches=100 [...]&lt;/CODE&gt;. You can also use &lt;CODE&gt;maxsearches=0&lt;/CODE&gt; to have no limit. However, I'd avoid using &lt;CODE&gt;map&lt;/CODE&gt; for this, because you can restructure this to not use &lt;CODE&gt;map&lt;/CODE&gt; at all, and doing so will launch a new search for every result from the base search - a very inefficient way to find what you're looking for. See if this restructured query will give you what you're looking for:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| inputlookup dataset2 where 
[ | inputlookup dataset1 where vid="*A212*"
   | eval vid="*".vid."*"
   | stats values(vid) AS vid 
   | format ]
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;This restructured query takes the values from dataset1, reformats them with wildcards, and uses them as a search filter for dataset2.&lt;/P&gt;</description>
    <pubDate>Wed, 24 Jan 2018 18:04:26 GMT</pubDate>
    <dc:creator>elliotproebstel</dc:creator>
    <dc:date>2018-01-24T18:04:26Z</dc:date>
    <item>
      <title>Map with inputlookup not working</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Map-with-inputlookup-not-working/m-p/333051#M93437</link>
      <description>&lt;P&gt;I have a dataset 1 like:&lt;BR /&gt;
&lt;CODE&gt;VID&lt;BR /&gt;
A212&lt;BR /&gt;
A213&lt;BR /&gt;
B151&lt;BR /&gt;
B153&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;Dataset 2 like: &lt;BR /&gt;
&lt;CODE&gt;QID    Solution&lt;BR /&gt;
2145  text contains A212&lt;BR /&gt;
2155  text contains B151&lt;BR /&gt;
2157  text contains A212&lt;BR /&gt;
2855  text contains B151&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;Wanted output like: &lt;BR /&gt;
&lt;CODE&gt;VID  QID  Solution&lt;/CODE&gt;  -&amp;gt; for all matching cases &lt;/P&gt;

&lt;P&gt;I tried the following search for a single item search and it is working fine&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;|from inputlookup:"dataset1" |where like(vid,"%A212%")|stats values(vid) as vid
|map [|from inputlookup:"dataset2" |where like(Solution,"%".$vid$."%") |Table QID,Solution] 
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;But when the main search returns multiple values, it is not working - shows no results.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;|from inputlookup:"dataset1" |where like(vid,"%A%")|stats values(vid) as vid
    |map [|from inputlookup:"dataset2" |where like(Solution,"%".$vid$."%") |Table QID,Solution] 
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;What am i doing wrong here ?&lt;/P&gt;</description>
      <pubDate>Wed, 24 Jan 2018 15:13:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Map-with-inputlookup-not-working/m-p/333051#M93437</guid>
      <dc:creator>nsraoch1975</dc:creator>
      <dc:date>2018-01-24T15:13:40Z</dc:date>
    </item>
    <item>
      <title>Re: Map with inputlookup not working</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Map-with-inputlookup-not-working/m-p/333052#M93438</link>
      <description>&lt;P&gt;The &lt;CODE&gt;map&lt;/CODE&gt; command will, by default, only take the first ten values. If you'd like it to look at more than ten, you need to use the &lt;CODE&gt;maxsearches&lt;/CODE&gt; flag, like: &lt;CODE&gt;| map maxsearches=100 [...]&lt;/CODE&gt;. You can also use &lt;CODE&gt;maxsearches=0&lt;/CODE&gt; to have no limit. However, I'd avoid using &lt;CODE&gt;map&lt;/CODE&gt; for this, because you can restructure this to not use &lt;CODE&gt;map&lt;/CODE&gt; at all, and doing so will launch a new search for every result from the base search - a very inefficient way to find what you're looking for. See if this restructured query will give you what you're looking for:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| inputlookup dataset2 where 
[ | inputlookup dataset1 where vid="*A212*"
   | eval vid="*".vid."*"
   | stats values(vid) AS vid 
   | format ]
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;This restructured query takes the values from dataset1, reformats them with wildcards, and uses them as a search filter for dataset2.&lt;/P&gt;</description>
      <pubDate>Wed, 24 Jan 2018 18:04:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Map-with-inputlookup-not-working/m-p/333052#M93438</guid>
      <dc:creator>elliotproebstel</dc:creator>
      <dc:date>2018-01-24T18:04:26Z</dc:date>
    </item>
  </channel>
</rss>

