Map command to append value

[astatrial]

Hello all,
I have a lookup table with saved searches names, search strings, time range and some other values.
I am trying to use inputlookup to get the content of the lookup, and then to run map command which will run the saved search and append the result (count.)
Like this:

| inputlookup lookup_file.csv
| map search="| savedsearch $search_name$"

This removes all the other results.

Does anyone knows how to add the results (in order), to every row (not to insert the lookup, just to append it to the inputlookup results).

Thanks!

[koshyk]

Sorry, why are you doing like this rather than putting the searches within savedsearches.conf? this means you cannot get the full potential of your saved-searches or automation which comes up with Splunk and scheduling functionality etc.

If you really need to maintain a single CSV and version control, then the idea for large scale automation is

1. Maintain your CSV file with savedsearches name, search, cron_schedule (basically all required parameters from savedsearches.conf)
2. Then using an orchestrator software (like Ansible or script of your own), populate the savedsearches.conf automatically
3. Then just copy the savedsearches.conf into your Splunk installation on a regular basis/deployment/releases.

Using map command and running each savedsearches is very primitive and would lead to inconsistent results or less flexibility like time parsing.

[astatrial]

Hi,
I am not sure if i understood you.
I created all the saved searches in advance. (So it means they will be added to the savedsearches.conf no ? ).

I just use the lookup to call the name of the saved search and than i run it with the command | savedsearch . But i want to leave the name of the searches beside the result.