Splunk Search

Splunk add quotes when passing searches stored in a lookup table to the datamodel search using map?

BacPhan-2005
New Member

According to https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-instruct-Splunk-to-not-add-quotes-wh... I have try to do the same thing with data model search but I have encountered to error that unable to query .... 

 

| inputlookup internalcheck.csv
| fields check
| map maxsearches=100 search="$check$"

 

BacPhan2005_0-1758776964120.png

However search with raw SPL will not be invalid 

search="| tstats count from datamodel=Endpoint.Registry ..."

 Can I have some solutions about doing multiple search queries from data model?

Labels (4)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Are you absolutely sure about the contents of your csv? The error message suggests you have extra single quotes. That would effectively make your search not 

| tstats something something

but 

'| tstats something something'
0 Karma
Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Community Feedback

We Want to Hear from You! Share Your Feedback on the Splunk Community   The Splunk Community is built for you ...

Manual Instrumentation with Splunk Observability Cloud: Implementing the ...

In our observability journey so far, we've built comprehensive instrumentation for our Worms in Space ...