I've concluded that I absolutely need to use mapping, as I need to run the same (large) search query for each Iteration, the list of which must be found through another search. The Iteration must be referenced several times throughout this large search. However, this search also contains other necessary subsearches which use the Iteration as a variable. It works when hardcoded, but I can't pass the $Iteration$ thing into the inner subsearch.
<search to find Iterations> | map [ search index=caac sourcetype=UserStory _time<[| inputlookup caac_900_Sprint_Dates_lu where Iteration=$Iteration$ | return $epochSprintBegDate] ]
The actual search is much larger, but this is the portion of interest.
This will return the error: "Error in 'search' command: Unable to parse the search: Comparator '<' is missing a term on the right hand side."
I don't think you want to use
time< to set your time period. Use earliest/latest instead. Check out this previous question for how this could be accomplished:
I'm sure there are more examples of this as well, this one just happened to be fresh on my mind.
_time was the issue
It works with a hardcoded Iteration but not with the mapped one, for some reason; but I did find an alternate method 🙂
The problem might be the dollar syntax. How about you give this a try. (renaming the output field to keyward
search will return it's string value.
<search to find Iterations> | map [ search index=caac sourcetype=UserStory _time<[| inputlookup caac_900_Sprint_Dates_lu | where Iteration=$Iteration$ | tabel epochSprintBegDate | rename epochSprintBegDate as query] ]