Splunk Search

map command alternative

Simr
New Member

Hi  Everyone,


I had been using map command on a set of few tens of entries . Basically it gets Busername field and searches customer's status using curl command. But now the data set is getting bigger (might get to 1-2k) and i could sense map command would be too inefficient a way here. What alternate way can i use instead of map command? I am not sure if i can use nested search in this case. 

| inputlookup Data_Topology where "location"="WINDSOR"
| table BUsername
| map maxsearches=100 search="| curl method=get uri=https://mdoss-api.****.corp.com/v2/customers/$BUsername$
| spath input=curl_message
| fields - curl*
**some data**=*"

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like your curl command is retrieving data for each BUsername, so if you want to avoid calling the curl command multiple times, you need a way of calling it fewer times but retrieve data on multiple BUsernames at once Do you have such a capability?

0 Karma

Simr
New Member

I am afraid i cant avoid that. Busername is unique and i will need to precisely call it for each entry.

0 Karma
Get Updates on the Splunk Community!

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...

Data Management Digest – January 2026

Welcome to the January 2026 edition of Data Management Digest! Welcome to the January 2026 edition of Data ...