Splunk Search

Is there any way to achieve below search results

VatsalJagani
SplunkTrust
SplunkTrust

Best way to write search where we want to pass result from one search to other and we still want to keep results of first search as it is.

<some search> 
| map search="| customcommand value=$url$"
| fields url, <fields_from_custom_command>, <fields_from_above_search>

I've above search but as we all know it will not return fields_from_above_search. My target is to also get fields_from_above_search. One solution that immediately came to my mind is appendpipe command followed by stats, but unfortunately it is giving error with map command, it works with other search.

<some search> 
| appendpipe [| map search="| customcommand value=$url$"]
| fields url, <fields_from_custom_command>, <fields_from_above_search>

Error in 'map' command: Unable to find saved search 'search='.

If possible, optimized solution is even good as customcommand support comma separated urls in value argument. So here customcommand will run only once which is very good optimization.

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@VatsalJagani

You can access the main Search fields by eval in map search. Can you please try it by taking reference to the below sample search?

| makeresults | eval Field1="ABCD" | map search=" | makeresults | eval count=1, Field1=\"$Field1$\",Field2=\"$Field1$\" "

In case of nested map you can try below search

| makeresults | eval Field1="ABCD" | map search=" | makeresults | eval count=1, Field1=\"$Field1$\",Field2=\"$Field1$\" | map search=\" | makeresults | eval ABC=10,Field1=\\\"$Field1$\\\",Field2=\\\"$Field1$\\\" \" "

Thanks

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@VatsalJagani

You can access the main Search fields by eval in map search. Can you please try it by taking reference to the below sample search?

| makeresults | eval Field1="ABCD" | map search=" | makeresults | eval count=1, Field1=\"$Field1$\",Field2=\"$Field1$\" "

In case of nested map you can try below search

| makeresults | eval Field1="ABCD" | map search=" | makeresults | eval count=1, Field1=\"$Field1$\",Field2=\"$Field1$\" | map search=\" | makeresults | eval ABC=10,Field1=\\\"$Field1$\\\",Field2=\\\"$Field1$\\\" \" "

Thanks

Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...