topic Re: Why. does the map search breaks my base search? in Splunk Search

Why does the map search break my base search?

andrew_burnett — Tue, 10 May 2022 21:57:16 GMT

So I have this search looking to send emails to people logging into a legacy SH, but the map command breaks my results.

index=_audit sourcetype = audittrail action="login attempt"|eval user=user.""."@gmail.com"|fields user|map search="sendemail to=$user$ subject=Please Stoping Using Old SH message="Please migrate to new SH" sendresults=true inline=true format=raw"

Re: Why. does the map search breaks my base search?

bowesmana — Tue, 10 May 2022 04:32:13 GMT

In what way does it break the results. By 'base search' do you mean a base search in a dashboard?

One comment about the search. You are double quoting the message string but not subject.

Re: Why. does the map search breaks my base search?

andrew_burnett — Tue, 10 May 2022 04:39:36 GMT

I mean that the base search I mean the part of the search before the map command

Re: Why. does the map search breaks my base search?

ITWhisperer — Tue, 10 May 2022 06:35:50 GMT

A search is a pipeline of processing instructions for events - processing further down the pipeline cannot directly affect processing higher up in the pipeline.

How do you know it is "broken"?

Re: Why. does the map search breaks my base search?

isoutamo — Tue, 10 May 2022 06:39:56 GMT

You can check from python.log what are those arguments which have sent by sendemail.

Re: Why. does the map search breaks my base search?

andrew_burnett — Tue, 10 May 2022 14:02:15 GMT

Everything before the map command works, until I add that last half.

Re: Why. does the map search breaks my base search?

ITWhisperer — Tue, 10 May 2022 15:51:18 GMT

Do you need to escape the double quotes used in the search string?

Re: Why. does the map search breaks my base search?

andrew_burnett — Tue, 10 May 2022 17:08:35 GMT

In the eval? That's to actually make them into email strings

Re: Why. does the map search breaks my base search?

ITWhisperer — Tue, 10 May 2022 17:37:49 GMT

Something like this (untested)

index=_audit sourcetype = audittrail action="login attempt"|eval user=user.""."@gmail.com"|fields user|map search="sendemail to=$user$ subject=\"Please Stoping Using Old SH\" message=\"Please migrate to new SH\" sendresults=true inline=true format=raw"

Re: Why. does the map search breaks my base search?

andrew_burnett — Tue, 10 May 2022 21:23:49 GMT

I don't need to escape them, but it is still broken.

Re: Why. does the map search breaks my base search?

ITWhisperer — Tue, 10 May 2022 22:19:48 GMT

Have you tried it with escaped quotes?

index=_audit sourcetype = audittrail action="login attempt"|eval user=user.""."@gmail.com"|fields user|map search="sendemail to=\"$user$\" subject=\"Please Stoping Using Old SH\" message=\"Please migrate to new SH\" sendresults=true inline=true format=raw"

Re: Why. does the map search breaks my base search?

bowesmana — Tue, 10 May 2022 22:34:25 GMT

I suggested you quote the subject string, like you have quoted the message string - did you do that?

Can you also give us some indication of what 'it is broken' means - can you describe or upload a screenshot of what 'broken' means