Splunk Search

MAP command in splunk

arjitgoswami
Explorer

Hi Team, I am having a difficulty in understanding map command. In the below commands, we need to extract work order ID from one sourcetype and using that, I need to extract sessionid corresponding to that work order ID.

sourcetype=XYZ QI-*|rex "FINISH:\sWO\sID\sis\s\s(?[^\s]+)"|stats values(WOID) as WOID|map search="search sourcetype=ABC val=$WOID$|stats values(sessionid)"

When I just using one Work order (QI-12345) I am getting the result. But when I am using QI-* (which has 6 such work order ID) , I am not able to get results. Could you please help?

Thanks ,
Arjit.

Tags (2)
0 Karma
1 Solution

niketn
Legend

@arjitgoswami, you r base search is returning multi-value result. Try the following:

 sourcetype="pega17052017n" QI-535653 OR QI-535654
 | stats count by WOID
 | rename WOID as val
 | table val
 | map search="search sourcetype=\"QI-535653\" QI-* val=$val$
                           | stats values(sessionid) by val" maxsearches=10
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@arjitgoswami, you r base search is returning multi-value result. Try the following:

 sourcetype="pega17052017n" QI-535653 OR QI-535654
 | stats count by WOID
 | rename WOID as val
 | table val
 | map search="search sourcetype=\"QI-535653\" QI-* val=$val$
                           | stats values(sessionid) by val" maxsearches=10
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

arjitgoswami
Explorer

Thanks @niketnilay ! adding stats count by WOID helped to send single valued result to map command. It looks like only count function (and not stats(values) or table command) is sending single values data to map command

0 Karma

niketn
Legend

Hi @arjitgoswamy, since it was a duplicate thread (https://answers.splunk.com/answers/542641/map-command-in-splunk.html), where I had answered your question, I have pasted my comment here as an answer. Please accept to mark this as closed.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

woodcock
Esteemed Legend

Try this:

sourcetype="pega17052017n" QI-535653 OR QI-535654|stats values(WOID) as val
| table val
| map maxsearches=10 search="search sourcetype=\"QI-535653\" QI-* val=$val$|stats values(sessionid) by val"
0 Karma

dineshraj9
Builder

You have to pass values one by one to the map search command. Try something like this -

sourcetype=pega17052017n QI-*|rex "UWCChange\sStage\sFINISH:\sWO\sID\sis\s\s(?[^\s]+)"|dedup WOID | table WOID |map search="search sourcetype=QI-535653 val=$WOID$|stats values(sessionid) "
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...