topic Re: map command subsearch issue in Splunk Search

map command subsearch issue

francescafilini — Wed, 13 May 2015 14:40:08 GMT

Hi, I have an issue with map command. The query is:

index=myindex field=value |stats count by host| map maxsearches=100 search="search index=myindex host=$host$|outputtext usexml=false |fields raw| fields - _time, xml| outputcsv  $host$.[search | head 1 | eval start=strftime(relative_time(now(), "-7d@d"), "%d_%m_%Y")| eval end=strftime(relative_time(now(), "-1d@d"), "%d_%m_%Y")|eval query="from".start."_to_".end.".txt"| fields query| format "" "" "" "" "" ""]"

but is does not return results. Any hint? Thank you

Re: map command subsearch issue

martin_mueller — Wed, 13 May 2015 15:43:59 GMT

What are you trying to achieve?

Re: map command subsearch issue

francescafilini — Wed, 13 May 2015 15:52:35 GMT

I'm trying to have a file with all the raw data in the index "myindex"

Re: map command subsearch issue

martin_mueller — Wed, 13 May 2015 18:43:43 GMT

You can easily export all the raw data in the index myindex by running this from the CLI:

$SPLUNK_HOME/bin/splunk export eventdata -index myindex -dir /some/dir/

Re: map command subsearch issue

francescafilini — Thu, 14 May 2015 07:42:19 GMT

Thank you, but I need a different file for each host in the index (the parameter in map command)

Re: map command subsearch issue

martin_mueller — Thu, 14 May 2015 09:24:46 GMT

I see. In that case, give this a shot in the web UI:

index=myindex | eval _dstpath = host | dump basefilename=myexport

That'll create one directory per host under $SPLUNK_HOME/var/run/splunk/dispatch/sid/dump and dump the raw events for that host there.