Splunk Search

Shouldn't this map command work?

wkupersa
Path Finder

|stats count|eval cip='foo'|map search="search index=* Address=$cip$"

It errors out saying "Error in 'map': Did not find value for required attribute 'cip'."

Tags (2)
0 Karma
1 Solution

MuS
Legend

Hi wkupersa,

use it like this:

|stats count|eval cip="foo"|map search="search index=* Address=$cip$"

This will set the value of cip to be foo. In your original search you did set the value of cip to be the value of the field called foo.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi wkupersa,

use it like this:

|stats count|eval cip="foo"|map search="search index=* Address=$cip$"

This will set the value of cip to be foo. In your original search you did set the value of cip to be the value of the field called foo.

Hope this helps ...

cheers, MuS

wkupersa
Path Finder

Geez. Single quotes versus double. Feeling brain dead. Thanks!

0 Karma

MuS
Legend

you're welcome 🙂

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...