Splunk Search

Understanding map command

mtrochym
Observer

I am banging my head trying to understand the map command and how it works. I have one search that returns values:

index=offers sourcetype=offer producttype=* earliest=-5m latest=now
| stats count by producttype
| table producttype

This gives me the a set of data. So far so good.
|producttype|
1

3
9
12

What I thought map did was to pass these $productID$ values to the 'mapped query and run it up to maxsearches time (in this case 4). So my next line was :

map maxsearches=4 search = "index=offers sourcetype=offer producttype=$producttype$ earliest=-5m latest=now
| timechart ...some stuff...
| blah blah
| etc.... "

I get no results found. (This is a simplified version of my search and the foreach is not going to be an option with my final goal). What am I failing to understand? Thank you in advance!

Tags (1)
0 Karma

woodcock
Esteemed Legend

You are missing the search operator just inside of the double-quotes; like this:

index=offers sourcetype=offer producttype=* earliest=-5m latest=now
| stats count by producttype
| map maxsearches=4 search="search index=offers sourcetype=offer producttype=$producttype$ earliest=-5m latest=now
| timechart ...some stuff...
| blah blah
| etc.... "
0 Karma

richgalloway
SplunkTrust
SplunkTrust

@aberkow makes a good point. map is powerful, but costly and there often are other ways to accomplish the task. Try a subsearch.
In this example, the query within brackets (the subsearch) fetches your product types. Change the argument to head to return the desired number of producttype values. The results of the subsearch become part of the main search, like index=offers sourcetype=offers (producttype=1 OR producttype=3 OR producttype=9 OR producttype=12)) earliest=-5m ....

index=offers sourcetype=offer [index=offers sourcetype=offer producttype=* earliest=-5m latest=now
| stats count by producttype | head 4
| fields producttype | format ] earliest=-5m latest=now
| timechart ...some stuff...
| blah blah
| etc.... 
---
If this reply helps you, Karma would be appreciated.
0 Karma

woodcock
Esteemed Legend

The subsearch way seems to work but it is not documented as supported for a very good reason that is fairly complicated; You should stick to using double-quotes. See my answer.

0 Karma

aberkow
Builder

What are you trying to accomplish with the map command? I've rarely run into a case where I need it over different commands

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...