topic Understanding map command in Splunk Search

Understanding map command

mtrochym — Wed, 23 Oct 2019 23:15:23 GMT

I am banging my head trying to understand the map command and how it works. I have one search that returns values:

index=offers sourcetype=offer producttype=* earliest=-5m latest=now
| stats count by producttype
| table producttype

This gives me the a set of data. So far so good.
|producttype|
1

3
9
12

What I thought map did was to pass these $productID$ values to the 'mapped query and run it up to maxsearches time (in this case 4). So my next line was :

map maxsearches=4 search = "index=offers sourcetype=offer producttype=$producttype$ earliest=-5m latest=now
| timechart ...some stuff...
| blah blah
| etc.... "

I get no results found. (This is a simplified version of my search and the foreach is not going to be an option with my final goal). What am I failing to understand? Thank you in advance!

Re: Understanding map command

aberkow — Wed, 23 Oct 2019 23:23:20 GMT

What are you trying to accomplish with the map command? I've rarely run into a case where I need it over different commands

Re: Understanding map command

richgalloway — Thu, 24 Oct 2019 04:19:24 GMT

@aberkow makes a good point. map is powerful, but costly and there often are other ways to accomplish the task. Try a subsearch.
In this example, the query within brackets (the subsearch) fetches your product types. Change the argument to head to return the desired number of producttype values. The results of the subsearch become part of the main search, like index=offers sourcetype=offers (producttype=1 OR producttype=3 OR producttype=9 OR producttype=12)) earliest=-5m ....

index=offers sourcetype=offer [index=offers sourcetype=offer producttype=* earliest=-5m latest=now
| stats count by producttype | head 4
| fields producttype | format ] earliest=-5m latest=now
| timechart ...some stuff...
| blah blah
| etc....

Re: Understanding map command

woodcock — Fri, 25 Oct 2019 23:58:03 GMT

You are missing the search operator just inside of the double-quotes; like this:

index=offers sourcetype=offer producttype=* earliest=-5m latest=now
| stats count by producttype
| map maxsearches=4 search="search index=offers sourcetype=offer producttype=$producttype$ earliest=-5m latest=now
| timechart ...some stuff...
| blah blah
| etc.... "

Re: Understanding map command

woodcock — Fri, 25 Oct 2019 23:59:10 GMT

The subsearch way seems to work but it is not documented as supported for a very good reason that is fairly complicated; You should stick to using double-quotes. See my answer.