Splunk Search

Why is the collect command not working when used with map command?

TiagoTLD1
Communicator

If I do this search

 index=log NOT "*INFO*" earliest=-40d@d latest=-39d@d 
 | cluster t=0.3 field=raw showcount=t labelonly=false delims=" "
 | eval old_label=cluster_label 
 | eventstats sum(cluster_count) as total_events 
 | eval Freq_Baseline=cluster_count/total_events 
 | fields _time, raw, old_label, cluster_count, Freq_Baseline, total_events 
 | collect index=clusters

Everything gets collected in index=clusters

BUT if I include this in a map,

index=is_log | head 1 
| streamstats count as latest 
| eval latest = 40
| eval earliest=latest + 1
| eval earliest= tostring(-earliest) + "d@d"  
| eval latest= tostring(-latest) + "d@d" 
| map maxsearches=35 search="search index=is_log NOT "*INFO*" earliest=$earliest$ latest=$latest$ 
 | cluster t=0.3 field=raw showcount=t labelonly=false delims=" "
 | eval old_label=cluster_label 
 | eventstats sum(cluster_count) as total_events 
 | eval Freq_Baseline=cluster_count/total_events 
 | fields _time, raw, old_label, cluster_count, Freq_Baseline, total_events 
 | collect index=clusters"

Then nothing is collected in the index, although the same results show up on the screen

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

The quotes in delims=" " may need to be escaped.

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

The quotes in delims=" " may need to be escaped.

0 Karma

TiagoTLD1
Communicator

Thank you 🙂

0 Karma

rvanteru
New Member

The above command was really helpful so what if want to move source of data to other index without changing values to stash.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...