How to edit my map command search in order to pass a field to subsearch within subsearch?

[snreichel]

I've concluded that I absolutely need to use mapping, as I need to run the same (large) search query for each Iteration, the list of which must be found through another search. The Iteration must be referenced several times throughout this large search. However, this search also contains other necessary subsearches which use the Iteration as a variable. It works when hardcoded, but I can't pass the $Iteration$ thing into the inner subsearch.

<search to find Iterations>
| map 
    [ search index=caac sourcetype=UserStory _time<[| inputlookup caac_900_Sprint_Dates_lu where Iteration=$Iteration$ | return $epochSprintBegDate] ]

The actual search is much larger, but this is the portion of interest.
This will return the error: "Error in 'search' command: Unable to parse the search: Comparator '<' is missing a term on the right hand side."

[somesoni2]

The problem might be the dollar syntax. How about you give this a try. (renaming the output field to keyward query or search will return it's string value.

<search to find Iterations>
 | map 
     [ search index=caac sourcetype=UserStory _time<[| inputlookup caac_900_Sprint_Dates_lu | where Iteration=$Iteration$ | tabel epochSprintBegDate | rename epochSprintBegDate as query] ]

[micahkemp · Accepted solution]

I don't think you want to use time< to set your time period. Use earliest/latest instead. Check out this previous question for how this could be accomplished:

Using a time selector in a .dashboard - how can i make modifications to latest time in a query?

I'm sure there are more examples of this as well, this one just happened to be fresh on my mind.

[snreichel]

_time was the issue
It works with a hardcoded Iteration but not with the mapped one, for some reason; but I did find an alternate method 🙂