Splunk Search

Using the map command to run searches from a lookup.

paras
Explorer

I have this lookup that has a list of searches I want to run.

Screen Shot 2022-06-02 at 8.52.39 AM.png

I want to run a search that can run output the "magic" values search results. The expected search.

This is the search I am using, " | inputlookup test.csv  | map search=$magic$ "

When I run this this is the error I am getting:

Unable to run query '"search index::client* sourcetype::ActiveDirectory | fields admonEventType memberOf sAMAccountName sAMAccountType | head 100 | fieldsummary maxvals=2 | where count > 0 | table field values"'.
"
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try using a double map

| inputlookup test.csv
| map search="| makeresults | map search="$$magic$$

chrisyounger
SplunkTrust
SplunkTrust

For anyone else like me in the future trying to get this to work, the solution from @ITWhisperer is for use in a dashboard. You should be able to get this to work outside a dashboard like so: 

| inputlookup test.csv
| map search="| makeresults | map search=\"$magic$\""
0 Karma
Get Updates on the Splunk Community!

Buttercup Games Tutorial Extension - part 9

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games Tutorial Extension - part 8

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Introducing the Splunk Developer Program!

Hey Splunk community! We are excited to announce that Splunk is launching the Splunk Developer Program in ...