How to use a field outside of map as map's search query?

[yaharga]

I have a field called query that's like so:

(index="abc" OR index="def") (host="ghi" OR host="jkl") (sourcetype="mno" sourcetype="pqr") (source="stu" source="vwx") "*yz*"

I am trying to leverage it in a map search:

 <search that gets me the above field> | map search="search $query$"

 It doesn't seem to work. How do I go about doing it if another way is possible?

Just to clarify, map doesn't have to be the only solution; I simply need a solution to use the query field to perform a search per row (in addition to stats count) to find the number of results returned for each search.

[ITWhisperer]

Try something like this

 <search that gets me the above field> | map search="search index=$index$ sourcetype=$sourcetype$ source=$source$ host=$host$"

[yaharga]

What should $index$ be to work with your solution? There are a variable number of indexes:

map search="search index=$index$"

$index$ can be changed using eval to whatever I want, so:

• index="abc" OR index="def"

• abc,def

• "abc","def"

• abc
  def

I can't do

map search="search (index=$indexA$ OR index=$indexB$)"

because $index$ is a multivalue field that's variable in length.

[ITWhisperer]

The map command works on each event in the pipeline i.e. the events returned by the search. Each event will have come from an index, a sourcetype, a source and a host. Each event could have different sets or the same values for each. The search in map as I showed should use the values for the event it is processing.

[yaharga]

The results from the first search are not events. They're from makeresults and eval. I made a table for my desired indexes, hosts, sourcetypes, and sources.

[ITWhisperer]

OK sounds like similar to this

https://community.splunk.com/t5/Splunk-Search/Using-the-map-command-to-run-searches-from-a-lookup/m-... 

[yaharga]

| makeresults
| eval query="search (index=\"abc\" OR index=\"def\") (host=\"ghi\" OR host=\"jkl\") (sourcetype=\"mno\" sourcetype=\"pqr\") (source=\"stu\" source=\"vwx\") \"*yz*\""
| map search="| makeresults | map search="$$$$query$$$$

Should the above work? I'm using it in a dashboard form.

[ITWhisperer · Accepted solution]

Double $ should be OK for dashboards

https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-run-query-returned-from-Rest/m-p/598...