I am attempting to use the ‘map’ command with a sub search. In the subsearch I am using I wish to use the value of _time for the value of ‘earliest’ in the subsearch. Here is a simplified representation of the query I am attempting to perform:
index = "yyyy" | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) as RequestRecvd_earliest | map [search index = "zzzz" earliest=$RequestRecvd_earliest$]
When I run this query, I get the following error:
Invalid value "$RequestRecvd_earliest$" for time term 'earliest’
This happens if I use the values ‘earliest’ or ‘latest’. If I use some other field name such as ‘bob’, I do not get this error.
Does anyone have any idea about what is going on here?
Pretty sure earliest accepts an epoch value, so all the conversion is not needed.
This returns 10 events which is correct :
* | head 10 | tail 1 | rename _time as time | map search="search * earliest=$time$"
It doesnt like $_time$ for some reason, so you have to rename it.
The above search doesn't seem to work with the [ ] notation, I always have problems with it.
Pretty sure earliest accepts an epoch value, so all the conversion is not needed.
This returns 10 events which is correct :
* | head 10 | tail 1 | rename _time as time | map search="search * earliest=$time$"
It doesnt like $_time$ for some reason, so you have to rename it.
The above search doesn't seem to work with the [ ] notation, I always have problems with it.
OK thanks for the info. I think you may have indirectly answered my question. Your observation that the subsearch notation does not work seems to be the key. If I instead use your suggested notation, it works as expected. I also noticed that the parser is very particular about the exact format – ‘search=”…”’ works while ‘search = “…”’ (notice the spaces around ‘=’) does not work. This is probably what steered me towards the subsearch notation earlier. I wonder if subsearches make sense here since technically they are run first, which would not useful in this scenario