topic Re: How to retain fields from base search to use after a map command? in Splunk Search

How to retain fields from base search to use after a map command?

att35 — Tue, 20 Feb 2024 15:17:52 GMT

We have a search where one of the fields from base search is passed onto a REST API using map command.

<Base Search> | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by user, src_ip, activity, riskLevel |map maxsearches=100 search="| rest splunk_server=local /services/App/.../ ioc="$src_ip$"

But after this search ,only the results returned by the REST API are shown. How can I include some of the fields from original search, e.g. user, activity so that they can later be used in a table?

Tried adding the field using eval right before the REST call but that doesn't seem to be working.

eval activity=\"$activity$\" | rest

Also tried using "multireport" but only the first search is considered.

| multireport [ table user, src_ip, activity, riskLevel] [| map map maxsearches=100 search="| rest splunk_server=local /services/App/.../ ioc="$src_ip$"]

Is there a way to achieve this? API call itself returns a set of fields which I am extracting using spath but also want to keep some of the original ones for added context.

Thanks,

~Abhi

Re: How to retain fields from base search to use after a map command?

ITWhisperer — Tue, 20 Feb 2024 16:02:34 GMT

The first command of the map search needs to be a generating command, such as rest. Try adding the eval afterwards.

Re: How to retain fields from base search to use after a map command?

att35 — Tue, 20 Feb 2024 16:04:50 GMT

Thanks @ITWhisperer

This worked.