How to get to a working example of the Map Command?

[muebel]

I am trying:

name=foo minutesago=1 | head 1000 | dedup host | stats list(host) as list | map search="search host=$list$ | head 1"

the "name=foo minutesago=1" search will return a bunch of events from about 8 or 9 hosts. When I run the above search, I get 1 event back. I would expect 1 event from each host, per my understanding of the Map command.

Is there something here I am doing wrong? Could somebody provide a working example of Map in action? I suppose I might be passing the "$list$" variable incorrectly, but the documentation is a bit scant.

EDIT: Working search:

name=foo minutesago=1 | head 1000 | dedup host | map search="search host=$host$ | head 1"

[Stephen_Sorkin · Accepted solution]

My guess here is that the map command doesn't like the multivalued field that the stats command is outputting. What happens if you remove the stats command from your search?

[muebel]

ah... thats it. So the variable is all the values of a field in the collection of events that you pipe to map.