topic Is there any way to have the below query without map command? in Splunk Search

Is there any way to have the below query without map command?

Abilan1 — Tue, 29 Sep 2020 09:16:20 GMT

Hi ,

With the below query, am facing issue while creating dashboard, as it is having a map command.

is there any other way to make the same without map command.

Re: Is there any way to have the below query without map command?

javiergn — Thu, 31 Mar 2016 07:47:43 GMT

You could use a subsearch. Something like:

index=foo [
    search index=Test host=XXX "ABNUM" | dedup source | table source
] 
| streamstats current=f last(_raw) AS next_line 
| search " took " next_line="ABNUM"
| dedup _raw next_line 
| rex "query took (?\d+).*((?\d+) seconds)"

Re: Is there any way to have the below query without map command?

sideview — Fri, 01 Apr 2016 21:20:17 GMT

Can you add a row of two to illustrate what your raw data looks like? I think that would help us answer your question better.

Also, this is a bit off the cuff, but I have a suspicion that what you need revolves around using the somewhat advanced "by" argument to streamstats.

index=Test host=XXX "ABNUM" | streamstats current=f last(_raw) AS next_line by source | ....

Re: Is there any way to have the below query without map command?

Abilan1 — Sat, 02 Apr 2016 21:21:06 GMT

Hi,

I would like to capture the seconds which is highlighted on the below logs and only for the table ABNUM (which is on next event).

Note: There are other tables like EmpID,USER,etc..will also be a part of the source file. But I need only for ABNUM table's query time. Please let me know if you need any additional information.

Log File:

Sun Mar 27 13:07:28.654666 doQueryDiagnostics: The following SQL query took 4 seconds which is equal to or greater than QueryExecutionTimeThreshold (4 seconds)

Sun Mar 27 13:07:28.654975 SELECT * FROM ABNUM WHERE ( RPAN8 = 68537110.000000 )

Re: Is there any way to have the below query without map command?

techusky — Mon, 04 Apr 2016 17:52:52 GMT

I'm not sure if this is the problem you are facing, but you can use the "map" command in dashboards just fine... however, since dashboards use the $field$ syntax to represent any input values to the dashboard (and map commands use the same syntax to reference the value of a given input field), you need to add a second $ around any variables in your map command. So for instance, when you define your search inside your dashboard, it would be something like this:

index=Test host=XXX "ABNUM" | map search="search source=$$source$$ | streamstats current=f last(_raw) AS next_line
| search \" took \" next_line=\"ABNUM\"" | dedup _raw next_line | rex "query took (?\d+).*((?\d+) seconds)"

Re: Is there any way to have the below query without map command?

Abilan1 — Tue, 05 Apr 2016 15:13:57 GMT

It is not working on search, not sure I didn't try for dashboard. am looking for a query which works in both dashboard as well as search.