Splunk Search

Is there any way to have the below query without map command?

Path Finder

Hi ,

With the below query, am facing issue while creating dashboard, as it is having a map command.

index=Test host=XXX "ABNUM" | map search="search source=$source$ | streamstats current=f last(_raw) AS next_line | search \" took \" next_line=\"ABNUM\"" | dedup _raw next_line | rex "query took (?\d+).*((?\d+) seconds)"

is there any other way to make the same without map command.


I'm not sure if this is the problem you are facing, but you can use the "map" command in dashboards just fine... however, since dashboards use the $field$ syntax to represent any input values to the dashboard (and map commands use the same syntax to reference the value of a given input field), you need to add a second $ around any variables in your map command. So for instance, when you define your search inside your dashboard, it would be something like this:

index=Test host=XXX "ABNUM" | map search="search source=$$source$$ | streamstats current=f last(_raw) AS next_line
| search \" took \" next_line=\"ABNUM\"" | dedup _raw next_line | rex "query took (?\d+).*((?\d+) seconds)"
0 Karma

Path Finder

It is not working on search, not sure I didn't try for dashboard. am looking for a query which works in both dashboard as well as search.

0 Karma


Can you add a row of two to illustrate what your raw data looks like? I think that would help us answer your question better.

Also, this is a bit off the cuff, but I have a suspicion that what you need revolves around using the somewhat advanced "by" argument to streamstats.

index=Test host=XXX "ABNUM" | streamstats current=f last(_raw) AS next_line by source | .... 
0 Karma

Path Finder


I would like to capture the seconds which is highlighted on the below logs and only for the table ABNUM (which is on next event).

Note: There are other tables like EmpID,USER,etc..will also be a part of the source file. But I need only for ABNUM table's query time. Please let me know if you need any additional information.

Log File:

Sun Mar 27 13:07:28.654666 doQueryDiagnostics: The following SQL query took 4 seconds which is equal to or greater than QueryExecutionTimeThreshold (4 seconds)

Sun Mar 27 13:07:28.654975 SELECT * FROM ABNUM WHERE ( RPAN8 = 68537110.000000 )

0 Karma


You could use a subsearch. Something like:

index=foo [
    search index=Test host=XXX "ABNUM" | dedup source | table source
| streamstats current=f last(_raw) AS next_line 
| search " took " next_line="ABNUM"
| dedup _raw next_line 
| rex "query took (?\d+).*((?\d+) seconds)"
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...