topic Shouldn't this map command work? in Splunk Search

Shouldn't this map command work?

wkupersa — Wed, 29 Jul 2015 22:06:02 GMT

|stats count|eval cip='foo'|map search="search index=* Address=$cip$"

It errors out saying "Error in 'map': Did not find value for required attribute 'cip'."

MuS — Wed, 29 Jul 2015 22:10:16 GMT

Hi wkupersa,

use it like this:

|stats count|eval cip="foo"|map search="search index=* Address=$cip$"

This will set the value of cip to be foo. In your original search you did set the value of cip to be the value of the field called foo.

Hope this helps ...

cheers, MuS

wkupersa — Wed, 29 Jul 2015 22:14:58 GMT

Geez. Single quotes versus double. Feeling brain dead. Thanks!

MuS — Wed, 29 Jul 2015 22:16:57 GMT

you're welcome 🙂