Run a generating command over a set of values

[burwell]

I have a search that will return a number of search ids.

index=_audit | <various modifications>| table search_id

Example.. I end up with

search_id

1604617764.7885_5E002618-3E1F-491E-88C9-516508A9DB66
1604617764.7886_5E002618-3E1F-491E-88C9-516508A9DB66
1604617764.7887_5E002618-3E1F-491E-88C9-516508A9DB66

Now for each of search_id I want to do a rest call to find out information about the search

For example, for the first search_id I want to call:

| rest services/search/jobs/1604617764.7885_5E002618-3E1F-491E-88C9-516508A9DB66 splunk_server=local

Since | rest is a generating command, I can't figure out how to do this.

[burwell]

The map command was exactly what I needed. And thanks for the correction of the services command (works with/without first /)

Also, if you have other fields you want to refer to in map use $field$

[bowesmana · Accepted solution]

You can use the map command

| map maxsearches=100 search="
  | rest services/search/jobs/$search_id$ splunk_server=local
  | table *
"

 https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Map

However, there are some runtime and performance limits that will affect how many ids you can run over.

Hope this helps

[isoutamo]

Hi
Map is exactly correct command for this kind of task. Small fix to your example “rest /services/...” for someone else who are not so familiar with splunk.
r. Ismo