Specify span option value in bin command with map

elensare — Tue, 03 Sep 2024 12:53:41 GMT

I try to use lookup to specify span option value in bin command with map

| inputlookup mylookupup.csv | fields Index, SearchString ,Tdiv | map [ search index="$Index$" _raw="*$SearchString$*" | bin span="$Tdiv$" _time]

The previous request fails with :

Error in 'bin' command: The value for option span (Tdiv) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value.

Example of values in Tdiv field :

could you help me with this problem?

Re: Specify span option value in bin command with map

PickleRick — Tue, 03 Sep 2024 13:26:24 GMT

I think I've seen this somewhere. For some reason map sometimes behaves differently if the search is specified in square brackets and differently if it's passed as parameter to the search= option.

Try the latter form (remembering about proper escaping)

| inputlookup mylookupup.csv | fields Index, SearchString ,Tdiv | map search="search index=\"$Index$\" _raw=\"*$SearchString$*\" | bin span=\"$Tdiv$\" _time"

topic Specify span option value in bin command with map in Splunk Search

Specify span option value in bin command with map

Re: Specify span option value in bin command with map