topic Re: How to use a field outside of map as map's search query? in Splunk Search

How to use a field outside of map as map's search query?

yaharga — Fri, 03 Jun 2022 08:57:52 GMT

I have a field called query that's like so:

(index="abc" OR index="def") (host="ghi" OR host="jkl") (sourcetype="mno" sourcetype="pqr") (source="stu" source="vwx") "*yz*"

I am trying to leverage it in a map search:

 <search that gets me the above field> | map search="search $query$"

It doesn't seem to work. How do I go about doing it if another way is possible?

Just to clarify, map doesn't have to be the only solution; I simply need a solution to use the query field to perform a search per row (in addition to stats count) to find the number of results returned for each search.

Re: How to use a field outside of map as map's search query?

ITWhisperer — Fri, 03 Jun 2022 09:12:44 GMT

Try something like this

<search that gets me the above field> | map search="search index=$index$ sourcetype=$sourcetype$ source=$source$ host=$host$"

Re: How to use a field outside of map as map's search query?

yaharga — Fri, 03 Jun 2022 09:25:07 GMT

What should $index$ be to work with your solution? There are a variable number of indexes:

map search="search index=$index$"

$index$ can be changed using eval to whatever I want, so:

```
index="abc" OR index="def"
```
```
abc,def
```
```
"abc","def"
```
```
abc
def
```

I can't do

map search="search (index=$indexA$ OR index=$indexB$)"

because $index$ is a multivalue field that's variable in length.

Re: How to use a field outside of map as map's search query?

ITWhisperer — Fri, 03 Jun 2022 09:33:09 GMT

The map command works on each event in the pipeline i.e. the events returned by the search. Each event will have come from an index, a sourcetype, a source and a host. Each event could have different sets or the same values for each. The search in map as I showed should use the values for the event it is processing.

Re: How to use a field outside of map as map's search query?

yaharga — Fri, 03 Jun 2022 09:51:04 GMT

The results from the first search are not events. They're from makeresults and eval. I made a table for my desired indexes, hosts, sourcetypes, and sources.

Re: How to use a field outside of map as map's search query?

ITWhisperer — Fri, 03 Jun 2022 10:08:13 GMT

OK sounds like similar to this

https://community.splunk.com/t5/Splunk-Search/Using-the-map-command-to-run-searches-from-a-lookup/m-p/600309#M208976

Re: How to use a field outside of map as map's search query?

yaharga — Fri, 03 Jun 2022 10:57:43 GMT

| makeresults
| eval query="search (index=\"abc\" OR index=\"def\") (host=\"ghi\" OR host=\"jkl\") (sourcetype=\"mno\" sourcetype=\"pqr\") (source=\"stu\" source=\"vwx\") \"*yz*\""
| map search="| makeresults | map search="$$$$query$$$$

Should the above work? I'm using it in a dashboard form.

Re: How to use a field outside of map as map's search query?

ITWhisperer — Fri, 03 Jun 2022 11:04:00 GMT

Double $ should be OK for dashboards

https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-run-query-returned-from-Rest/m-p/598166#M208295