Why is there a problem when passing a command through a variable in map-command?

[ppatrikfr]

Hi guys,

| inputlookup Threshold_Perfil.csv 
| join perfil max=0 
    [| inputlookup Perfis_Threshold.csv 
    | fields perfil counter object 
    | dedup perfil counter object ] 
| eval counter= "counter='"."".counter.""."' " 
| eval object= " object='".object."' " 
| eval cmdline= " (".counter.object.") OR " 
| stats values(cmdline) as cmdline by host perfil 
| mvcombine delim="," cmdline 
| head 10 
| map search="earliest=-1h index="main" $cmdline$ sourcetype="nullableone" | stats count by object counter"

I'm using search above trying to pass a collection of counter and objects to make my search...

(counter='% Processor Time' object='Processor' ) OR (counter='Status' object='SWInterface' ) 

I have many servers and I want to check if Splunk is collecting correctly in each server, but when I'm passing my "cmdline" my map command is not running because splunk adds quotes after and before "cmdline" field.

earliest=-1h index=main " (counter='% Processor Time' object='Processor' ) OR (counter='Status' object='SWInterface' ) OR (counter='Temperatura' object='Temperatura' ) OR (counter='network_updown' object='ping' ) OR (counter='snmpwalk' object='bgp_router_status' ) OR " sourcetype=nullableone | stats count by object counter'.

If there is another way to do this I'll be happy to see.

[woodcock]

Also, see this Q&A for a super-flexible general approach to handle this kind of thing:

https://answers.splunk.com/answers/719456/how-to-prevent-the-map-command-from-encapsulating.html?chi...

[somesoni2 · Accepted solution]

Give this a try

| inputlookup Threshold_Perfil.csv 
| join perfil max=0 
    [| inputlookup Perfis_Threshold.csv 
    | fields perfil counter object 
    | dedup perfil counter object ] 
|  eval counter="counter='".counter."' " 
| eval object=" object='".object."' " 
| eval cmdline= "(".counter.object.")" 
| stats values(cmdline) as cmdline by host delim=" OR " | nomv cmdline 
| head 10 
| map search="search earliest=-1h index="main" [gentimes start=-1 | eval search=\"$cmdline$\" | rex mode=sed field=search "s/\\\"//g" | table search]  sourcetype="nullableone" | stats count by object counter"

[woodcock]

Exactly what I was going to propose.

[niketn]

@ppatrikfr do you have some sample values for cmdline. Also do you want to use it as text filter or key value pair? From he query seems like it is a text filter.

Also is the issue while running above in Splunk Search window or in Dashboard?

[ppatrikfr]

cmdline =

(counter='% Processor Time' object='Processor' ) OR (counter='Status' object='SWInterface' ) OR (counter='Temperatura' object='Temperatura' ) OR (counter='network_updown' object='ping' ) OR (counter='snmpwalk' object='bgp_router_status' ) OR

I just want splunk to identify as search command but those quotes are making them just a text filter. Also I'm running in window not dashboard.