Splunk Search

Appending a field returned from map?

oclumbertruck
Explorer

Howdy folks, I have a question around using map.

I have a large query that essentially generate the the following table:

id, title, stuff
1, title-1, stuff-1
2, title-2, stuff-2
3, title-3, stuff-3

I have a macro that takes an id, does some computation and applies a ML (Machine Learning) model and spits out a field, all by itself called "data". Due to the transforms and computations applied in the macro, the id is not retained, solely the "data" field.

I'm experimenting with map, to try and pass $id$ to the macro, and append the "data" field to the table. It appears map has a hard time interpreting $id$ unless I use appendpipe to the following tune:

\previous search\ | table id title stuff | appendpipe [ map [ search \`myMacro($id$)\`]]

which outputs this :
id, title, stuff, data
1, title-1, stuff-1,
2, title-2, stuff-2,
3, title-3, stuff-3,
, , , data-1
, , , data-2
, , , data-3

So rather than the field being appended to the current row, it seems to be getting appended to the bottom of the table. I realize that if the macro would return the id, that stats would probably fix this, however, this is the challenge.... Any help would be appreciated, I've gone back and forth with trying to make map search=search... vs appendpipe and can't seem to get the return of the macro to append as a column inline as opposed to new rows....

Thanks...

Tags (3)
1 Solution

woodcock
Esteemed Legend

Try this:

\previous search\
| fields id title stuff
| multireport [ table id title stuff ]
              [ map search="search `myMacro($id$)` | eval id=$id$" ]
| stats values(*) AS * BY id

View solution in original post

woodcock
Esteemed Legend

Try this:

\previous search\
| fields id title stuff
| multireport [ table id title stuff ]
              [ map search="search `myMacro($id$)` | eval id=$id$" ]
| stats values(*) AS * BY id

oclumbertruck
Explorer

This was super close out of the box, and ultimately got me to where i need to be. In the macro, I added a | eval id="$id$" right before the model is applied. It seems that if I tried eval statements after the model apply, the new fields would not be created....

The double quotes were the stingers as well, those got me. So, being able to add the eval in the macro, means I didn't need the eval statement in the map portion, and everything is working great now. Thanks for the help!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...