Splunk Search

MAP command in splunk

arjitgoswami
Explorer

Hi Team, I am having a difficulty in understanding map command. In the below commands, we need to extract work order ID from one sourcetype and using that, I need to extract sessionid corresponding to that work order ID.

sourcetype=XYZ QI-*|rex "FINISH:\sWO\sID\sis\s\s(?[^\s]+)"|stats values(WOID) as WOID|map search="search sourcetype=ABC val=$WOID$|stats values(sessionid)"

When I just using one Work order (QI-12345) I am getting the result. But when I am using QI-* (which has 6 such work order ID) , I am not able to get results. Could you please help?

Thanks ,
Arjit.

Tags (2)
0 Karma
1 Solution

niketn
Legend

@arjitgoswami, you r base search is returning multi-value result. Try the following:

 sourcetype="pega17052017n" QI-535653 OR QI-535654
 | stats count by WOID
 | rename WOID as val
 | table val
 | map search="search sourcetype=\"QI-535653\" QI-* val=$val$
                           | stats values(sessionid) by val" maxsearches=10
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@arjitgoswami, you r base search is returning multi-value result. Try the following:

 sourcetype="pega17052017n" QI-535653 OR QI-535654
 | stats count by WOID
 | rename WOID as val
 | table val
 | map search="search sourcetype=\"QI-535653\" QI-* val=$val$
                           | stats values(sessionid) by val" maxsearches=10
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

arjitgoswami
Explorer

Thanks @niketnilay ! adding stats count by WOID helped to send single valued result to map command. It looks like only count function (and not stats(values) or table command) is sending single values data to map command

0 Karma

niketn
Legend

Hi @arjitgoswamy, since it was a duplicate thread (https://answers.splunk.com/answers/542641/map-command-in-splunk.html), where I had answered your question, I have pasted my comment here as an answer. Please accept to mark this as closed.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

woodcock
Esteemed Legend

Try this:

sourcetype="pega17052017n" QI-535653 OR QI-535654|stats values(WOID) as val
| table val
| map maxsearches=10 search="search sourcetype=\"QI-535653\" QI-* val=$val$|stats values(sessionid) by val"
0 Karma

dineshraj9
Builder

You have to pass values one by one to the map search command. Try something like this -

sourcetype=pega17052017n QI-*|rex "UWCChange\sStage\sFINISH:\sWO\sID\sis\s\s(?[^\s]+)"|dedup WOID | table WOID |map search="search sourcetype=QI-535653 val=$WOID$|stats values(sessionid) "
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...