Splunk Search

How to retain fields from base search to use after a map command?

att35
Builder

We have a search where one of the fields from base search is passed onto a REST API using map command. 

 

<Base Search> | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by user, src_ip, activity, riskLevel

|map maxsearches=100 search="| rest splunk_server=local /services/App/.../ ioc="$src_ip$"

 

 

But after this search ,only the results returned by the REST API are shown. How can I include some of the fields from original search, e.g. user, activity so that they can later be used in a table?

Tried adding the field using eval right before the REST call but that doesn't seem to be working. 

 

eval activity=\"$activity$\" | rest

 

 

Also tried using "multireport" but only the first search is considered. 

 

| multireport  [ table user, src_ip, activity, riskLevel]
[| map map maxsearches=100 search="| rest splunk_server=local /services/App/.../ ioc="$src_ip$"]

 

 

Is there a way to achieve this? API call itself returns a set of fields which I am extracting using spath but also want to keep some of the original ones for added context.

Thanks,

~Abhi

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The first command of the map search needs to be a generating command, such as rest. Try adding the eval afterwards.

<Base Search> | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by user, src_ip, activity, riskLevel

|map maxsearches=100 search="| rest splunk_server=local /services/App/.../ ioc=\"$src_ip$\"
| eval activity=\"$activity$\""

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The first command of the map search needs to be a generating command, such as rest. Try adding the eval afterwards.

<Base Search> | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by user, src_ip, activity, riskLevel

|map maxsearches=100 search="| rest splunk_server=local /services/App/.../ ioc=\"$src_ip$\"
| eval activity=\"$activity$\""

att35
Builder

Thanks @ITWhisperer 

This worked.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...