Splunk Search

How to retain fields from base search to use after a map command?

att35
Builder

We have a search where one of the fields from base search is passed onto a REST API using map command. 

 

<Base Search> | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by user, src_ip, activity, riskLevel

|map maxsearches=100 search="| rest splunk_server=local /services/App/.../ ioc="$src_ip$"

 

 

But after this search ,only the results returned by the REST API are shown. How can I include some of the fields from original search, e.g. user, activity so that they can later be used in a table?

Tried adding the field using eval right before the REST call but that doesn't seem to be working. 

 

eval activity=\"$activity$\" | rest

 

 

Also tried using "multireport" but only the first search is considered. 

 

| multireport  [ table user, src_ip, activity, riskLevel]
[| map map maxsearches=100 search="| rest splunk_server=local /services/App/.../ ioc="$src_ip$"]

 

 

Is there a way to achieve this? API call itself returns a set of fields which I am extracting using spath but also want to keep some of the original ones for added context.

Thanks,

~Abhi

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The first command of the map search needs to be a generating command, such as rest. Try adding the eval afterwards.

<Base Search> | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by user, src_ip, activity, riskLevel

|map maxsearches=100 search="| rest splunk_server=local /services/App/.../ ioc=\"$src_ip$\"
| eval activity=\"$activity$\""

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The first command of the map search needs to be a generating command, such as rest. Try adding the eval afterwards.

<Base Search> | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by user, src_ip, activity, riskLevel

|map maxsearches=100 search="| rest splunk_server=local /services/App/.../ ioc=\"$src_ip$\"
| eval activity=\"$activity$\""

att35
Builder

Thanks @ITWhisperer 

This worked.

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...