Does the map command support real-time search and is it streaming?

[spyme72]

I am trying to use the map command to trigger a new search each time a new event comes through to Splunk. The new search would be a saved search which triggers an email.

The whole search works for the initial set of data in the index, but when new data comes in, the saved search is not triggered. Does the map command support real-time search and is it streaming?

search

index=abc |fields to,subject,message
|map savedsearchabc

saved search

|sendemail to="$Address$" subject="$msg$" message="$msg$

[curtisb1024]

From the comments in this answer, it appears that map doesn't start it's search until the outer search completes. Because a real-time search never completes, the search triggered by the map command never runs.

So, no. Unfortunately the map command is not supported in real-time searches.

[satishsdange]

Hi -

Could you please let us know time is spent on running 1st search by looking at Job inspector?
There could be possibility that saved search is not getting triggered. Information about skipped searches could be found from scheduler.log