Splunk Search

Appending a field returned from map?

oclumbertruck
Explorer

Howdy folks, I have a question around using map.

I have a large query that essentially generate the the following table:

id, title, stuff
1, title-1, stuff-1
2, title-2, stuff-2
3, title-3, stuff-3

I have a macro that takes an id, does some computation and applies a ML (Machine Learning) model and spits out a field, all by itself called "data". Due to the transforms and computations applied in the macro, the id is not retained, solely the "data" field.

I'm experimenting with map, to try and pass $id$ to the macro, and append the "data" field to the table. It appears map has a hard time interpreting $id$ unless I use appendpipe to the following tune:

\previous search\ | table id title stuff | appendpipe [ map [ search \`myMacro($id$)\`]]

which outputs this :
id, title, stuff, data
1, title-1, stuff-1,
2, title-2, stuff-2,
3, title-3, stuff-3,
, , , data-1
, , , data-2
, , , data-3

So rather than the field being appended to the current row, it seems to be getting appended to the bottom of the table. I realize that if the macro would return the id, that stats would probably fix this, however, this is the challenge.... Any help would be appreciated, I've gone back and forth with trying to make map search=search... vs appendpipe and can't seem to get the return of the macro to append as a column inline as opposed to new rows....

Thanks...

Tags (3)
1 Solution

woodcock
Esteemed Legend

Try this:

\previous search\
| fields id title stuff
| multireport [ table id title stuff ]
              [ map search="search `myMacro($id$)` | eval id=$id$" ]
| stats values(*) AS * BY id

View solution in original post

woodcock
Esteemed Legend

Try this:

\previous search\
| fields id title stuff
| multireport [ table id title stuff ]
              [ map search="search `myMacro($id$)` | eval id=$id$" ]
| stats values(*) AS * BY id

oclumbertruck
Explorer

This was super close out of the box, and ultimately got me to where i need to be. In the macro, I added a | eval id="$id$" right before the model is applied. It seems that if I tried eval statements after the model apply, the new fields would not be created....

The double quotes were the stingers as well, those got me. So, being able to add the eval in the macro, means I didn't need the eval statement in the map portion, and everything is working great now. Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...