Splunk Search

Shouldn't this map command work?

Path Finder

|stats count|eval cip='foo'|map search="search index=* Address=$cip$"

It errors out saying "Error in 'map': Did not find value for required attribute 'cip'."

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi wkupersa,

use it like this:

|stats count|eval cip="foo"|map search="search index=* Address=$cip$"

This will set the value of cip to be foo. In your original search you did set the value of cip to be the value of the field called foo.

Hope this helps ...

cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

Hi wkupersa,

use it like this:

|stats count|eval cip="foo"|map search="search index=* Address=$cip$"

This will set the value of cip to be foo. In your original search you did set the value of cip to be the value of the field called foo.

Hope this helps ...

cheers, MuS

View solution in original post

Path Finder

Geez. Single quotes versus double. Feeling brain dead. Thanks!

0 Karma

SplunkTrust
SplunkTrust

you're welcome 🙂

0 Karma