topic map command alternative in Splunk Search

map command alternative

Simr — Tue, 29 Jun 2021 08:48:21 GMT

Hi Everyone,

I had been using map command on a set of few tens of entries . Basically it gets Busername field and searches customer's status using curl command. But now the data set is getting bigger (might get to 1-2k) and i could sense map command would be too inefficient a way here. What alternate way can i use instead of map command? I am not sure if i can use nested search in this case.

| inputlookup Data_Topology where "location"="WINDSOR"
| table BUsername
| map maxsearches=100 search="| curl method=get uri=https://mdoss-api.****.corp.com/v2/customers/$BUsername$
| spath input=curl_message
| fields - curl*
**some data**=*"

Re: map command alternative

ITWhisperer — Tue, 29 Jun 2021 08:54:09 GMT

It looks like your curl command is retrieving data for each BUsername, so if you want to avoid calling the curl command multiple times, you need a way of calling it fewer times but retrieve data on multiple BUsernames at once Do you have such a capability?

Re: map command alternative

Simr — Tue, 29 Jun 2021 08:56:17 GMT

I am afraid i cant avoid that. Busername is unique and i will need to precisely call it for each entry.