topic Re: Does the map command run the entire command, then each row? in Splunk Search

Does the map command run the entire command, then each row?

PatrickButterly — Thu, 31 Aug 2017 13:40:06 GMT

So I noticed this while using sendmail can somebody confirm that I understand the map commands functionality? I cant see it in the docs

if the command was "search ...| map [ | sendemail ..etc.. ]"

it would execute :
"search ... | sendemail ..etc.. ]"
"search row1 ... | sendemail ..etc.. ]"
"search row2 ... | sendemail ..etc.. ]"
and so on.

Thank you

Re: Does the map command run the entire command, then each row?

woodcock — Thu, 31 Aug 2017 14:17:23 GMT

That is exactly correct. Be aware that the default is maxsearches=5 so you might need to make it maxsearches=100 or something. Be careful, though; this spawns many searches and can easily lead to queuing and other "too busy" problems.

Re: Does the map command run the entire command, then each row?

PatrickButterly — Thu, 31 Aug 2017 14:36:06 GMT

Beautiful thanks very much for that

Re: Does the map command run the entire command, then each row?

aljohnson_splun — Thu, 31 Aug 2017 17:04:57 GMT

I think you mean maxsearches not limit

Re: Does the map command run the entire command, then each row?

woodcock — Thu, 31 Aug 2017 22:42:06 GMT

...waves hands... like I said!