What's wrong with this map search command

[raoul]

I am battling with the use of the map search command.

I have some queries that work fine by themselves, but when I try and combine them I get an error in the form: "Unable to run query XXX"

However, if I copy the quoted query that Splunk is "unable to run" and paste it into a new search by itself it runs without any problems.

The command I am using is:

sourcetype="WinEventLog:Application" "not known to the TermApp" | rex field=_raw "terminal ID (?<TID>.*) is not known" | lookup terminal_lookup TID OUTPUT PTID | stats count by PTID | search count>50 | map maxsearches=17 search="sourcetype="vc_termlog" TermID=$PTID$"

The edited down essence of this really:

<some search> | stats count by PTID | map maxsearches=17 search="sourcetype="vc_termlog" TermID=$PTID$"

The specific error I get is:

Unable to run query 'sourcetype=vc_termlog TermID=15157736'.

However when I run the query quoted in a separate search window it runs perfectly.

I have tried with and without maxsearches.

[carasso · Accepted solution]

Look at this snippet of your search:

... search="sourcetype="vc_termlog" TermID=$PTID$"

Look at the quoting! That's

... search="sourcetype="       vc_termlog      " TermID=$PTID$"

Now you see the problem? Also, I think your search needs to start with "search"

Try

... search="search sourcetype=vc_termlog TermID=$PTID$"

Or use the subsearch notation for map:

| map maxsearches=17 [search sourcetype="vc_termlog" TermID=$PTID$]

[gkanapathy]

It would be helpful to see the exact map command as well as the query.

[raoul]

Done, command added to question