topic Re: use source within map command in Splunk Search

use source within map command

chrkohm — Thu, 06 Aug 2020 08:09:04 GMT

Hi,

I have several log files that I´m "batch indexing".

for example:

file01.log file02.log file03.log file04.log

Now I´m searching if an field equals an value like State=4

And now I just want to do another search that searches only in this source-files where the State was 4.

I tried this:

index=test sourcetype=XY State=4 | stats count by source |map search="search index=test sourcetype=XY source=$source$ |stats values(cpu) by _time "

but I´m getting no results.

If I run the first search without the map section, I´m getting the source-files as an List

Re: use source within map command

to4kawa — Thu, 06 Aug 2020 09:39:30 GMT

| tstats max(PREFIX("cpu=")) as cpu where index=test sourcetype=XY (source=file01.log OR source=file02.log OR source=file03.log OR source=file04.log) by PREFIX("State=") _time
| where 'State='=4

Re: use source within map command

chrkohm — Thu, 06 Aug 2020 09:47:33 GMT

ok, but I can´t name every file.log because there are thousands...

Re: use source within map command

to4kawa — Thu, 06 Aug 2020 09:57:41 GMT

| tstats max(PREFIX("cpu=")) as cpu where index=test sourcetype=XY [|tstats count where index=test sourcetype=XY by source| fields source | format ] by PREFIX("State=") _time
| where 'State='=4

The conditions change too much.

Re: use source within map command

chrkohm — Fri, 07 Aug 2020 19:55:30 GMT

I figured it out: