Why does the map search break my base search?

[andrew_burnett]

So I have this search looking to send emails to people logging into a legacy SH, but the map command breaks my results. 

index=_audit sourcetype = audittrail action="login attempt"|eval user=user.""."@gmail.com"|fields user|map search="sendemail to=$user$ subject=Please Stoping Using Old SH message="Please migrate to new SH" sendresults=true inline=true format=raw"

[isoutamo]

You can check from python.log what are those arguments which have sent by sendemail.

[bowesmana]

In what way does it break the results. By 'base search' do you mean a base search in a dashboard?

One comment about the search. You are double quoting the message string but not subject. 

[andrew_burnett]

I mean that the base search I mean the part of the search before the map command

[bowesmana]

I suggested you quote the subject string, like you have quoted the message string - did you do that?

Can you also give us some indication of what 'it is broken' means - can you describe or upload a screenshot of what 'broken' means

[ITWhisperer]

A search is a pipeline of processing instructions for events - processing further down the pipeline cannot directly affect processing higher up in the pipeline.

How do you know it is "broken"?

[andrew_burnett]

Everything before the map command works, until I add that last half.

[ITWhisperer]

Do you need to escape the double quotes used in the search string?

[andrew_burnett]

In the eval? That's to actually make them into email strings

[ITWhisperer]

Something like this (untested)

index=_audit sourcetype = audittrail action="login attempt"|eval user=user.""."@gmail.com"|fields user|map search="sendemail to=$user$ subject=\"Please Stoping Using Old SH\" message=\"Please migrate to new SH\" sendresults=true inline=true format=raw"

[andrew_burnett]

I don't need to escape them, but it is still broken.

[ITWhisperer]

Have you tried it with escaped quotes?

index=_audit sourcetype = audittrail action="login attempt"|eval user=user.""."@gmail.com"|fields user|map search="sendemail to=\"$user$\" subject=\"Please Stoping Using Old SH\" message=\"Please migrate to new SH\" sendresults=true inline=true format=raw"