Splunk Search

Appending a field returned from map?

oclumbertruck
Explorer

Howdy folks, I have a question around using map.

I have a large query that essentially generate the the following table:

id, title, stuff
1, title-1, stuff-1
2, title-2, stuff-2
3, title-3, stuff-3

I have a macro that takes an id, does some computation and applies a ML (Machine Learning) model and spits out a field, all by itself called "data". Due to the transforms and computations applied in the macro, the id is not retained, solely the "data" field.

I'm experimenting with map, to try and pass $id$ to the macro, and append the "data" field to the table. It appears map has a hard time interpreting $id$ unless I use appendpipe to the following tune:

\previous search\ | table id title stuff | appendpipe [ map [ search \`myMacro($id$)\`]]

which outputs this :
id, title, stuff, data
1, title-1, stuff-1,
2, title-2, stuff-2,
3, title-3, stuff-3,
, , , data-1
, , , data-2
, , , data-3

So rather than the field being appended to the current row, it seems to be getting appended to the bottom of the table. I realize that if the macro would return the id, that stats would probably fix this, however, this is the challenge.... Any help would be appreciated, I've gone back and forth with trying to make map search=search... vs appendpipe and can't seem to get the return of the macro to append as a column inline as opposed to new rows....

Thanks...

Tags (3)
1 Solution

woodcock
Esteemed Legend

Try this:

\previous search\
| fields id title stuff
| multireport [ table id title stuff ]
              [ map search="search `myMacro($id$)` | eval id=$id$" ]
| stats values(*) AS * BY id

View solution in original post

woodcock
Esteemed Legend

Try this:

\previous search\
| fields id title stuff
| multireport [ table id title stuff ]
              [ map search="search `myMacro($id$)` | eval id=$id$" ]
| stats values(*) AS * BY id

oclumbertruck
Explorer

This was super close out of the box, and ultimately got me to where i need to be. In the macro, I added a | eval id="$id$" right before the model is applied. It seems that if I tried eval statements after the model apply, the new fields would not be created....

The double quotes were the stingers as well, those got me. So, being able to add the eval in the macro, means I didn't need the eval statement in the map portion, and everything is working great now. Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...