What fields are displayed when using the "map" command

[bruceclarke]

Hey all,

I have a search that uses the map command. It looks like:

<myBaseSearch>
| map [search index=main sourcetype=perfLogging userID=$userId$ splunk_server=$splunk_server$]

The resulting table displays a bunch of fields that aren't part of the perfLogging sourcetype; they are part of other sourcetypes in the main index though. These fields are empty, which leads me to believe the search is correct, but I am curious...

Is this expected behavior for the map command? In other words, should the resulting table have a column for all fields discovered in the index?

[martin_mueller · Accepted solution]

I've found the generic display of results after map weird at times - but you can rely on any computation done afterwards to be correct, for example a stats applied to the results.

Why are you using map for that though? It seems to me as if you could just use the base search as a subsearch producing a large filter in the now mapped search.

[martin_mueller]

Ah, I see. In that case using map likely is the way to go.

[bruceclarke]

Sorry, I didn't post the complete search. The base search actually provides time constraints for the mapped search.

Also, we are going to do more computation on the results, but I noticed the weird display first and wanted to see if anyone else saw this issue.

Thanks for the explanation.