Shouldn't this map command work?

[wkupersa]

|stats count|eval cip='foo'|map search="search index=* Address=$cip$"

It errors out saying "Error in 'map': Did not find value for required attribute 'cip'."

[MuS · Accepted solution]

Hi wkupersa,

use it like this:

|stats count|eval cip="foo"|map search="search index=* Address=$cip$"

This will set the value of cip to be foo. In your original search you did set the value of cip to be the value of the field called foo.

Hope this helps ...

cheers, MuS

[wkupersa]

Geez. Single quotes versus double. Feeling brain dead. Thanks!

[MuS]

you're welcome 🙂