- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am battling with the use of the map search command.
I have some queries that work fine by themselves, but when I try and combine them I get an error in the form: "Unable to run query XXX"
However, if I copy the quoted query that Splunk is "unable to run" and paste it into a new search by itself it runs without any problems.
The command I am using is:
sourcetype="WinEventLog:Application" "not known to the TermApp" | rex field=_raw "terminal ID (?<TID>.*) is not known" | lookup terminal_lookup TID OUTPUT PTID | stats count by PTID | search count>50 | map maxsearches=17 search="sourcetype="vc_termlog" TermID=$PTID$"
The edited down essence of this really:
<some search> | stats count by PTID | map maxsearches=17 search="sourcetype="vc_termlog" TermID=$PTID$"
The specific error I get is:
Unable to run query 'sourcetype=vc_termlog TermID=15157736'.
However when I run the query quoted in a separate search window it runs perfectly.
I have tried with and without maxsearches.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Look at this snippet of your search:
... search="sourcetype="vc_termlog" TermID=$PTID$"
Look at the quoting! That's
... search="sourcetype=" vc_termlog " TermID=$PTID$"
Now you see the problem? Also, I think your search needs to start with "search"
Try
... search="search sourcetype=vc_termlog TermID=$PTID$"
Or use the subsearch notation for map:
| map maxsearches=17 [search sourcetype="vc_termlog" TermID=$PTID$]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Look at this snippet of your search:
... search="sourcetype="vc_termlog" TermID=$PTID$"
Look at the quoting! That's
... search="sourcetype=" vc_termlog " TermID=$PTID$"
Now you see the problem? Also, I think your search needs to start with "search"
Try
... search="search sourcetype=vc_termlog TermID=$PTID$"
Or use the subsearch notation for map:
| map maxsearches=17 [search sourcetype="vc_termlog" TermID=$PTID$]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

It would be helpful to see the exact map
command as well as the query.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Done, command added to question
