topic Why does the map command return no results? in Splunk Search

Why does the map command return no results?

bojanisch — Wed, 07 Mar 2018 20:35:15 GMT

Hi everyone,

I have a use case where I need to iterate over multiple query strings and execute each of them, so I though of using the map command and passing the search query as a token to the map search like this
| makeresults count=1| eval query = "| makeresults count=1 | eval test=\"Hello\"" | map search="$query$" maxsearches=1

This search won't return any results. However if I put the search string directly in the mapping command I get the expected results

I thought that field values can be passed in mapping commands replacing their respective token. Although this is happening, the map command does not seem to execute the string as a query.

Does someone has an explanation for this behavior and maybe even a solution?

Re: Why does the map command return no results?

bojanisch — Wed, 07 Mar 2018 21:06:22 GMT

Okay after some more research I found out that Splunk isn't parsing the token as a query, but as a string.

03-07-2018 21:49:45.182 INFO SearchParser - PARSING: search "| makeresults count=1 | eval test=\"Hello\""

After passing the string through a macro, everything works as expected

where the macro is defined as

[getSearchAsString(1)]
args = search
definition = $search$
iseval = 0

Re: Why does the map command return no results?

valiquet — Fri, 09 Mar 2018 09:17:11 GMT

I think because you had quotes in query variable, you could have trimmed them