Splunk Search

Search field names with spaces in map command inner search

ErikaE
Communicator

I have data from a sourcetype that I am searching with a map command like so:

source=outersearch | map search="search source="innersource" | stats avg(Param)"  

This search runs correctly and returns the expected number of events from innersource. However, I would like to be able to search for a fieldname with a space in the inner search source. i.e. "Field Name"="String Value". When I isolate the inner search, it works just fine. When I include it in the map string:

source=outersearch | map search="search source="innersource" "Field Name"="String Value" | stats avg(Param)"   

The map search returns no results. The documentation says that the map search string is 'literal' but I can't find any documentation on what that means or how it constrains how the search has to be written.

0 Karma
1 Solution

woodcock
Esteemed Legend

Try this (demonstrates multiple approaches):

 source=outersearch | map search="search source=\"innersource\" $Field Name$='String Value' | stats avg(Param)" 

View solution in original post

woodcock
Esteemed Legend

Try this (demonstrates multiple approaches):

 source=outersearch | map search="search source=\"innersource\" $Field Name$='String Value' | stats avg(Param)" 

ErikaE
Communicator

The escape character ended up working great, i.e.:

\"Field Name with Space\"

It took a little bit of fiddling to figure out which parts of the inner search were causing issues.

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...