SPL map command

[torustad]

Good morning all,

I run this search

| makeresults count=4 | eval a="splunk_server" | map search="search index=esak-qa sourcetype=eport:access| table _time index $a$"

the value of the field splunk_server is listed in a column called splunk_server so it works as I want it to.

However, when I run this spl I get a column called "splunk_server host" with no values:

| makeresults count=4 | eval a="splunk_server host" | map search="search index=esak-qa sourcetype=eport:access| table _time index $a$"

How can I get two columns, namely splunk_server and host?
(I have also tried a="splunk_server,host")

Any tips?

Regards,
Bård Tørustad

[torustad]

The search is done using a timespan of 5 seconds around the _time of the event from the main search

[torustad]

Good morning and thanks for bearing over with me,

The problem with the rejected message was presumably that it contained sqlcode.

The primary search finds sql update statements from an index with windows events that are generated by an sqlserver. Then the attributes that are to be updated are extracted from the set-part of the sql update statement. (for example if a,y and z are the attributes to be updated then attrs is a comma separated list of the three)

[torustad]

So I tried to post the explanation again and got this:

Success!

• Click to go to your post.

and I clicked and got this:

This reply was marked as spam and has been removed. If you believe this is an error, submit an abuse report.

So I am lost....

[torustad]

No, that was a test to see if my response to you arrived which this test did.

I have tried to post a full explanation of what I want, but it seems to have been thrown away.