Splunk Search

Using the map command to run searches from a lookup.

paras
Explorer

I have this lookup that has a list of searches I want to run.

Screen Shot 2022-06-02 at 8.52.39 AM.png

I want to run a search that can run output the "magic" values search results. The expected search.

This is the search I am using, " | inputlookup test.csv  | map search=$magic$ "

When I run this this is the error I am getting:

Unable to run query '"search index::client* sourcetype::ActiveDirectory | fields admonEventType memberOf sAMAccountName sAMAccountType | head 100 | fieldsummary maxvals=2 | where count > 0 | table field values"'.
"
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try using a double map

| inputlookup test.csv
| map search="| makeresults | map search="$$magic$$
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...