topic Re: Does the map command support real-time search and is it streaming? in Splunk Search

Does the map command support real-time search and is it streaming?

spyme72 — Mon, 23 Feb 2015 13:59:25 GMT

I am trying to use the map command to trigger a new search each time a new event comes through to Splunk. The new search would be a saved search which triggers an email.

The whole search works for the initial set of data in the index, but when new data comes in, the saved search is not triggered. Does the map command support real-time search and is it streaming?

index=abc |fields to,subject,message
|map savedsearchabc

saved search

|sendemail to="$Address$" subject="$msg$" message="$msg$

Re: Does the map command support real-time search and is it streaming?

satishsdange — Tue, 24 Feb 2015 06:52:20 GMT

Hi -

Could you please let us know time is spent on running 1st search by looking at Job inspector?
There could be possibility that saved search is not getting triggered. Information about skipped searches could be found from scheduler.log

Re: Does the map command support real-time search and is it streaming?

curtisb1024 — Wed, 20 May 2015 15:25:44 GMT

From the comments in this answer, it appears that map doesn't start it's search until the outer search completes. Because a real-time search never completes, the search triggered by the map command never runs.

So, no. Unfortunately the map command is not supported in real-time searches.