topic Map command maxsearches unexpected behavior in Splunk Search

Map command maxsearches unexpected behavior

gkapitany — Thu, 03 Oct 2019 14:38:56 GMT

I have the search below:

index=stats_summary dest_ip=172.* 
| dedup src_ip dest_ip|  map maxsearches=100 search="| inputlookup networks.csv
| eval dip=$dest_ip$
| eval sip=$src_ip$
| eval dm=if(cidrmatch(cidr,$dest_ip$),1,0) 
| where  dm == 1 
| table * "
| table sip dip

The first search returns about 20K records. The lookup table has about 90 records. If I set the maxsearches to 100 then the search returns zero records. If I set maxsearches to 3500 then I get about 100+. According to the documentation, maxsearches controls how many times the map search iterates over each record from the first search. Any ideas on what I'm doing wrong?

Re: Map command maxsearches unexpected behavior

richgalloway — Thu, 03 Oct 2019 17:05:38 GMT

maxsearches does not mean "max results". It's the number of times the map command will run regardless of whether anything is found.
What are you trying to do? Perhaps we can suggest another method.

Re: Map command maxsearches unexpected behavior

gkapitany — Wed, 30 Sep 2020 02:28:25 GMT

I'm trying to get all src_ip for which the dest_ip in in one of the network ranges listed in network.csv. The lookup table consist of about 90 cidr ranges.

Re: Map command maxsearches unexpected behavior

gkapitany — Wed, 30 Sep 2020 02:28:31 GMT

I found and alternate solution based on another post. I had to update the transforms.conf file with:

[networks]
default_match = NONE
match_type = CIDR(cidrBlock)
check_permission = true
filename = networks.csv

The query below returns the results I was trying to get with map search:

index=stats_summary dest_ip=172.*
| dedup src_ip dest_ip
| lookup networks cidrBlock as dest_ip OUTPUT cidrBlock as dmatch
| where dmatch != "NONE"
| table src_ip dest_ip

Re: Map command maxsearches unexpected behavior

richgalloway — Thu, 03 Oct 2019 19:54:59 GMT

@gkapitany If your problem is resolved, please accept the answer to help future readers.