Splunk Search

Construct map command query in eval statement

drewg33
Engager

I am having trouble constructing a search command in an Eval statement. I stripped it down to its most basic form to troubleshoot, but I still can't get that to work.

| makeresults 
| eval test = "search earliest=1576263600 latest=1576512000 index=security sourcetype=host_info | head 10" 
| map search="$test$"

I also tried this which was recommended in a different splunk answers post, but that still didn't work for me on Splunk version 7.1.6.

| makeresults 
| eval test = "earliest=1576263600 latest=1576512000 index=security sourcetype=host_info | head 10" 
| map search="search [| makeresults | eval evaltest=$test$ | return $evaltest]"
0 Karma

Anantha123
Communicator

try giving double $ sign . passed variables should be in $$ sign.

| map search="search [| makeresults | eval evaltest="$$test$$" | return $evaltest]"

Get Updates on the Splunk Community!

Celebrating the Winners of the ‘Splunk Build-a-thon’ Hackathon!

We are thrilled to announce the winners of the Splunk Build-a-thon, our first-ever hackathon dedicated to ...

Why You Should Register for Splunk University at .conf25

Level up before .conf25 even begins Splunk University is back in Boston, September 6–8, and it’s your chance ...

Building Splunk proficiency is a marathon, not a sprint

Building Splunk skills is a lot like training for a marathon. It’s about consistent progress, celebrating ...