Splunk Search

Is there any way to achieve below search results

VatsalJagani
SplunkTrust
SplunkTrust

Best way to write search where we want to pass result from one search to other and we still want to keep results of first search as it is.

<some search> 
| map search="| customcommand value=$url$"
| fields url, <fields_from_custom_command>, <fields_from_above_search>

I've above search but as we all know it will not return fields_from_above_search. My target is to also get fields_from_above_search. One solution that immediately came to my mind is appendpipe command followed by stats, but unfortunately it is giving error with map command, it works with other search.

<some search> 
| appendpipe [| map search="| customcommand value=$url$"]
| fields url, <fields_from_custom_command>, <fields_from_above_search>

Error in 'map' command: Unable to find saved search 'search='.

If possible, optimized solution is even good as customcommand support comma separated urls in value argument. So here customcommand will run only once which is very good optimization.

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@VatsalJagani

You can access the main Search fields by eval in map search. Can you please try it by taking reference to the below sample search?

| makeresults | eval Field1="ABCD" | map search=" | makeresults | eval count=1, Field1=\"$Field1$\",Field2=\"$Field1$\" "

In case of nested map you can try below search

| makeresults | eval Field1="ABCD" | map search=" | makeresults | eval count=1, Field1=\"$Field1$\",Field2=\"$Field1$\" | map search=\" | makeresults | eval ABC=10,Field1=\\\"$Field1$\\\",Field2=\\\"$Field1$\\\" \" "

Thanks

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@VatsalJagani

You can access the main Search fields by eval in map search. Can you please try it by taking reference to the below sample search?

| makeresults | eval Field1="ABCD" | map search=" | makeresults | eval count=1, Field1=\"$Field1$\",Field2=\"$Field1$\" "

In case of nested map you can try below search

| makeresults | eval Field1="ABCD" | map search=" | makeresults | eval count=1, Field1=\"$Field1$\",Field2=\"$Field1$\" | map search=\" | makeresults | eval ABC=10,Field1=\\\"$Field1$\\\",Field2=\\\"$Field1$\\\" \" "

Thanks

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...