Splunk Search

How to retain fields from base search to use after a map command?

att35
Builder

We have a search where one of the fields from base search is passed onto a REST API using map command. 

 

<Base Search> | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by user, src_ip, activity, riskLevel

|map maxsearches=100 search="| rest splunk_server=local /services/App/.../ ioc="$src_ip$"

 

 

But after this search ,only the results returned by the REST API are shown. How can I include some of the fields from original search, e.g. user, activity so that they can later be used in a table?

Tried adding the field using eval right before the REST call but that doesn't seem to be working. 

 

eval activity=\"$activity$\" | rest

 

 

Also tried using "multireport" but only the first search is considered. 

 

| multireport  [ table user, src_ip, activity, riskLevel]
[| map map maxsearches=100 search="| rest splunk_server=local /services/App/.../ ioc="$src_ip$"]

 

 

Is there a way to achieve this? API call itself returns a set of fields which I am extracting using spath but also want to keep some of the original ones for added context.

Thanks,

~Abhi

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The first command of the map search needs to be a generating command, such as rest. Try adding the eval afterwards.

<Base Search> | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by user, src_ip, activity, riskLevel

|map maxsearches=100 search="| rest splunk_server=local /services/App/.../ ioc=\"$src_ip$\"
| eval activity=\"$activity$\""

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The first command of the map search needs to be a generating command, such as rest. Try adding the eval afterwards.

<Base Search> | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by user, src_ip, activity, riskLevel

|map maxsearches=100 search="| rest splunk_server=local /services/App/.../ ioc=\"$src_ip$\"
| eval activity=\"$activity$\""

att35
Builder

Thanks @ITWhisperer 

This worked.

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...