topic Re: Why is there a problem when passing a command through a variable in map-command? in Dashboards & Visualizations

Why is there a problem when passing a command through a variable in map-command?

ppatrikfr — Tue, 10 Jul 2018 11:37:15 GMT

Hi guys,

| inputlookup Threshold_Perfil.csv 
| join perfil max=0 
    [| inputlookup Perfis_Threshold.csv 
    | fields perfil counter object 
    | dedup perfil counter object ] 
| eval counter= "counter='"."".counter.""."' " 
| eval object= " object='".object."' " 
| eval cmdline= " (".counter.object.") OR " 
| stats values(cmdline) as cmdline by host perfil 
| mvcombine delim="," cmdline 
| head 10 
| map search="earliest=-1h index="main" $cmdline$ sourcetype="nullableone" | stats count by object counter"

I'm using search above trying to pass a collection of counter and objects to make my search...

(counter='% Processor Time' object='Processor' ) OR (counter='Status' object='SWInterface' )

I have many servers and I want to check if Splunk is collecting correctly in each server, but when I'm passing my "cmdline" my map command is not running because splunk adds quotes after and before "cmdline" field.

earliest=-1h index=main " (counter='% Processor Time' object='Processor' ) OR (counter='Status' object='SWInterface' ) OR (counter='Temperatura' object='Temperatura' ) OR (counter='network_updown' object='ping' ) OR (counter='snmpwalk' object='bgp_router_status' ) OR " sourcetype=nullableone | stats count by object counter'.

If there is another way to do this I'll be happy to see.

Re: Why is there a problem when passing a command through a variable in map-command?

niketn — Tue, 10 Jul 2018 11:52:27 GMT

@ppatrikfr do you have some sample values for cmdline. Also do you want to use it as text filter or key value pair? From he query seems like it is a text filter.

Also is the issue while running above in Splunk Search window or in Dashboard?

Re: Why is there a problem when passing a command through a variable in map-command?

ppatrikfr — Tue, 10 Jul 2018 12:16:05 GMT

cmdline =

(counter='% Processor Time' object='Processor' ) OR (counter='Status' object='SWInterface' ) OR (counter='Temperatura' object='Temperatura' ) OR (counter='network_updown' object='ping' ) OR (counter='snmpwalk' object='bgp_router_status' ) OR

I just want splunk to identify as search command but those quotes are making them just a text filter. Also I'm running in window not dashboard.

Re: Why is there a problem when passing a command through a variable in map-command?

somesoni2 — Tue, 10 Jul 2018 15:41:14 GMT

Give this a try

| inputlookup Threshold_Perfil.csv 
| join perfil max=0 
    [| inputlookup Perfis_Threshold.csv 
    | fields perfil counter object 
    | dedup perfil counter object ] 
|  eval counter="counter='".counter."' " 
| eval object=" object='".object."' " 
| eval cmdline= "(".counter.object.")" 
| stats values(cmdline) as cmdline by host delim=" OR " | nomv cmdline 
| head 10 
| map search="search earliest=-1h index="main" [gentimes start=-1 | eval search=\"$cmdline$\" | rex mode=sed field=search "s/\\\"//g" | table search]  sourcetype="nullableone" | stats count by object counter"

Re: Why is there a problem when passing a command through a variable in map-command?

woodcock — Tue, 10 Jul 2018 16:16:11 GMT

Exactly what I was going to propose.

Re: Why is there a problem when passing a command through a variable in map-command?

woodcock — Mon, 28 Jan 2019 22:53:34 GMT

Also, see this Q&A for a super-flexible general approach to handle this kind of thing:

https://answers.splunk.com/answers/719456/how-to-prevent-the-map-command-from-encapsulating.html?childToView=719011#answer-719011