Splunk Search

Having a problem substituting value for earliest in a map command

timpgray
Path Finder

I am attempting to use the ‘map’ command with a sub search. In the subsearch I am using I wish to use the value of _time for the value of ‘earliest’ in the subsearch. Here is a simplified representation of the query I am attempting to perform:

index = "yyyy" | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) as RequestRecvd_earliest | map [search index = "zzzz" earliest=$RequestRecvd_earliest$]

When I run this query, I get the following error:

Invalid value "$RequestRecvd_earliest$" for time term 'earliest’

This happens if I use the values ‘earliest’ or ‘latest’. If I use some other field name such as ‘bob’, I do not get this error.

Does anyone have any idea about what is going on here?

1 Solution

jonuwz
Influencer

Pretty sure earliest accepts an epoch value, so all the conversion is not needed.

This returns 10 events which is correct :

* | head 10 | tail 1 | rename _time as time | map search="search * earliest=$time$"

It doesnt like $_time$ for some reason, so you have to rename it.

The above search doesn't seem to work with the [ ] notation, I always have problems with it.

View solution in original post

jonuwz
Influencer

Pretty sure earliest accepts an epoch value, so all the conversion is not needed.

This returns 10 events which is correct :

* | head 10 | tail 1 | rename _time as time | map search="search * earliest=$time$"

It doesnt like $_time$ for some reason, so you have to rename it.

The above search doesn't seem to work with the [ ] notation, I always have problems with it.

timpgray
Path Finder

OK thanks for the info. I think you may have indirectly answered my question. Your observation that the subsearch notation does not work seems to be the key. If I instead use your suggested notation, it works as expected. I also noticed that the parser is very particular about the exact format – ‘search=”…”’ works while ‘search = “…”’ (notice the spaces around ‘=’) does not work. This is probably what steered me towards the subsearch notation earlier. I wonder if subsearches make sense here since technically they are run first, which would not useful in this scenario

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...