Splunk Search

command map not working

jrodriguezap
Contributor

Hi everyone
Someone who has used the map command who can help me, I am trying to bind the username of the 12 hours before the first search, but the result does not give any value

This is my query, maybe I'm doing something wrong

host=10.10.10.30 direction=in earliest=-15m latest=-1m| stats count by src_ip | map search="host=10.10.10.30 earliest=-12h latest=-15m  src_ip=$src_ip$ username=*"
0 Karma
1 Solution

to4kawa
Ultra Champion
 host=10.10.10.30 direction=in earliest=-15m latest=-1m
| stats count by src_ip 
| map search="search host=10.10.10.30 earliest=-12h latest=-15m  src_ip=$src_ip$ username=*"

see https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Map

View solution in original post

to4kawa
Ultra Champion
 host=10.10.10.30 direction=in earliest=-15m latest=-1m
| stats count by src_ip 
| map search="search host=10.10.10.30 earliest=-12h latest=-15m  src_ip=$src_ip$ username=*"

see https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Map

jrodriguezap
Contributor

It is true, I miss adding that.
Thanks a lot

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...