topic Using the map command to run searches from a lookup. in Splunk Search

Using the map command to run searches from a lookup.

paras — Thu, 02 Jun 2022 12:56:30 GMT

I have this lookup that has a list of searches I want to run.

I want to run a search that can run output the "magic" values search results. The expected search.

This is the search I am using, " | inputlookup test.csv | map search=$magic$ "

When I run this this is the error I am getting:

"

Re: Using the map command to run searches from a lookup.

ITWhisperer — Thu, 02 Jun 2022 15:39:31 GMT

Try using a double map

| inputlookup test.csv | map search="| makeresults | map search="$$magic$$

Re: Using the map command to run searches from a lookup.

chrisyounger — Mon, 12 Feb 2024 05:00:38 GMT

For anyone else like me in the future trying to get this to work, the solution from @ITWhisperer is for use in a dashboard. You should be able to get this to work outside a dashboard like so:

| inputlookup test.csv | map search="| makeresults | map search=\"$magic$\""