Splunk Search

Map command maxsearches unexpected behavior

Explorer

I have the search below:

index=stats_summary dest_ip=172.* 
| dedup src_ip dest_ip|  map maxsearches=100 search="| inputlookup networks.csv
| eval dip=$dest_ip$
| eval sip=$src_ip$
| eval dm=if(cidrmatch(cidr,$dest_ip$),1,0) 
| where  dm == 1 
| table * "
| table sip dip

The first search returns about 20K records. The lookup table has about 90 records. If I set the maxsearches to 100 then the search returns zero records. If I set maxsearches to 3500 then I get about 100+. According to the documentation, maxsearches controls how many times the map search iterates over each record from the first search. Any ideas on what I'm doing wrong?

0 Karma
1 Solution

Explorer

I found and alternate solution based on another post. I had to update the transforms.conf file with:

[networks]
defaultmatch = NONE
match
type = CIDR(cidrBlock)
check_permission = true
filename = networks.csv

The query below returns the results I was trying to get with map search:

index=statssummary destip=172.*
| dedup srcip destip
| lookup networks cidrBlock as destip OUTPUT cidrBlock as dmatch
| where dmatch != "NONE"
| table src
ip dest_ip

View solution in original post

Explorer

I found and alternate solution based on another post. I had to update the transforms.conf file with:

[networks]
defaultmatch = NONE
match
type = CIDR(cidrBlock)
check_permission = true
filename = networks.csv

The query below returns the results I was trying to get with map search:

index=statssummary destip=172.*
| dedup srcip destip
| lookup networks cidrBlock as destip OUTPUT cidrBlock as dmatch
| where dmatch != "NONE"
| table src
ip dest_ip

View solution in original post

SplunkTrust
SplunkTrust

@gkapitany If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkTrust
SplunkTrust

maxsearches does not mean "max results". It's the number of times the map command will run regardless of whether anything is found.
What are you trying to do? Perhaps we can suggest another method.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

I'm trying to get all srcip for which the destip in in one of the network ranges listed in network.csv. The lookup table consist of about 90 cidr ranges.

0 Karma