topic Re: Run a generating command over a set of values in Splunk Search

Run a generating command over a set of values

burwell — Fri, 06 Nov 2020 02:24:21 GMT

I have a search that will return a number of search ids.

index=_audit | <various modifications>| table search_id

Example.. I end up with

search_id

1604617764.7885_5E002618-3E1F-491E-88C9-516508A9DB66
1604617764.7886_5E002618-3E1F-491E-88C9-516508A9DB66
1604617764.7887_5E002618-3E1F-491E-88C9-516508A9DB66

Now for each of search_id I want to do a rest call to find out information about the search

For example, for the first search_id I want to call:

| rest services/search/jobs/1604617764.7885_5E002618-3E1F-491E-88C9-516508A9DB66 splunk_server=local

Since | rest is a generating command, I can't figure out how to do this.

Re: Run a generating command over a set of values

bowesmana — Fri, 06 Nov 2020 03:40:22 GMT

You can use the map command

| map maxsearches=100 search=" | rest services/search/jobs/$search_id$ splunk_server=local | table * "

https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Map

However, there are some runtime and performance limits that will affect how many ids you can run over.

Hope this helps

Re: Run a generating command over a set of values

isoutamo — Fri, 06 Nov 2020 06:02:47 GMT

Hi
Map is exactly correct command for this kind of task. Small fix to your example “rest /services/...” for someone else who are not so familiar with splunk.
r. Ismo

Re: Run a generating command over a set of values

burwell — Fri, 06 Nov 2020 19:26:45 GMT

The map command was exactly what I needed. And thanks for the correction of the services command (works with/without first /)

Also, if you have other fields you want to refer to in map use $field$