Splunk Search

Splunk add quotes when passing searches stored in a lookup table to the datamodel search using map?

BacPhan-2005
Observer

According to https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-instruct-Splunk-to-not-add-quotes-wh... I have try to do the same thing with data model search but I have encountered to error that unable to query .... 

 

| inputlookup internalcheck.csv
| fields check
| map maxsearches=100 search="$check$"

 

BacPhan2005_0-1758776964120.png

However search with raw SPL will not be invalid 

search="| tstats count from datamodel=Endpoint.Registry ..."

 Can I have some solutions about doing multiple search queries from data model?

Labels (4)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Are you absolutely sure about the contents of your csv? The error message suggests you have extra single quotes. That would effectively make your search not 

| tstats something something

but 

'| tstats something something'
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...