topic Re: map command not working in Splunk Search

map command not working

arjitgoswami — Thu, 25 May 2017 11:31:32 GMT

Hi All,

when I am trying to run the subsearch separately, I am getting values. But when I am using map to run the below query, I am not getting any results.

sourcetype="pega17052017n" QI-535653 OR QI-535654|stats values(WOID) as val|table val|map search="[search sourcetype=\"QI-535653\" QI-* val=$val$|stats values(sessionid) by val" maxsearches=10

Can you please help?

Thanks and regards,
Arjit goswami.

Re: map command not working

cmerriman — Thu, 25 May 2017 12:08:11 GMT

this question was asked earlier. https://answers.splunk.com/answers/542641/map-command-in-splunk.html for reference.

Re: map command not working

niketn — Thu, 25 May 2017 12:16:18 GMT

@arjitgoswami, you r base search is returning multi-value result. Try the following:

sourcetype="pega17052017n" QI-535653 OR QI-535654
| stats count by WOID
| rename WOID as val
| table val
| map search="search sourcetype=\"QI-535653\" QI-* val=$val$
                          | stats values(sessionid) by val" maxsearches=10

Re: map command not working

woodcock — Thu, 25 May 2017 12:16:31 GMT

Try this:

sourcetype="pega17052017n" QI-535653 OR QI-535654|stats values(WOID) as val
| table val
| map maxsearches=10 search="search sourcetype=\"QI-535653\" QI-* val=$val$|stats values(sessionid) by val"

They key is removing the extra [ character.

Re: map command not working

arjitgoswami — Fri, 26 May 2017 08:24:48 GMT

Thanks a lot @niketnilay. Its worked !!