I have a use case where I need to iterate over multiple query strings and execute each of them, so I though of using the map command and passing the search query as a token to the map search like this
| makeresults count=1| eval query = "| makeresults count=1 | eval test=\"Hello\"" | map search="$query$" maxsearches=1
This search won't return any results. However if I put the search string directly in the mapping command I get the expected results
| makeresults count=1| eval query = "" | map search="| makeresults count=1 | eval test=\"Hello\"" maxsearches=1
I thought that field values can be passed in mapping commands replacing their respective token. Although this is happening, the map command does not seem to execute the string as a query.
Does someone has an explanation for this behavior and maybe even a solution?