topic What fields are displayed when using the "map" command in Splunk Search

What fields are displayed when using the "map" command

bruceclarke — Fri, 20 Jun 2014 18:12:01 GMT

Hey all,

I have a search that uses the map command. It looks like:

<myBaseSearch>
| map [search index=main sourcetype=perfLogging userID=$userId$ splunk_server=$splunk_server$]

The resulting table displays a bunch of fields that aren't part of the perfLogging sourcetype; they are part of other sourcetypes in the main index though. These fields are empty, which leads me to believe the search is correct, but I am curious...

Is this expected behavior for the map command? In other words, should the resulting table have a column for all fields discovered in the index?

Re: What fields are displayed when using the "map" command

martin_mueller — Fri, 20 Jun 2014 18:50:37 GMT

I've found the generic display of results after map weird at times - but you can rely on any computation done afterwards to be correct, for example a stats applied to the results.

Why are you using map for that though? It seems to me as if you could just use the base search as a subsearch producing a large filter in the now mapped search.

Re: What fields are displayed when using the "map" command

bruceclarke — Fri, 20 Jun 2014 18:55:27 GMT

Sorry, I didn't post the complete search. The base search actually provides time constraints for the mapped search.

Also, we are going to do more computation on the results, but I noticed the weird display first and wanted to see if anyone else saw this issue.

Thanks for the explanation.

Re: What fields are displayed when using the "map" command

martin_mueller — Fri, 20 Jun 2014 18:58:52 GMT

Ah, I see. In that case using map likely is the way to go.