Splunk Search

map command field not being evaluated

brdr
Contributor

I have an issue with a field within the map command not being evaluated appropriately. The scenario is this:

do something...
| table puser phost earliest latest
| map search="search index=winevents src_ip=$phost$ earliest=$earliest$ latest=$latest$ | eval puser=$puser$ | eval phost=$phost$ | head 1" maxsearches=100
| table puser phost

The issue is that 'phost' will display results only when the phost is an ip address. If the 'phost' value is a host name it will not display. Any idea why? NOTE: when I display the puser, phost via the first table command i get host name values. Only when map command runs do the host names not display in the second table command.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You should probably change src_ip=$phost$ to either src=$phost$ or host=$phost$ or similar. It seems exceedingly unlikely that a field called src_ip would contain anything other than an IP address.

View solution in original post

woodcock
Esteemed Legend

You are either running in Fast Mode instead of Smart Mode OR you may be running into this problem, depending on how your field is created:

https://www.splunk.com/blog/2011/10/07/cannot-search-based-on-an-extracted-field.html

0 Karma

brdr
Contributor

Ok. i will take a look at the document. I have been running in smart mode. I have one more question if you don't mind sir. After the map command runs I table puser and phost. After that I need to perform a lookup of the puser to get the full name of the puser. And, then table puser, full name, phost. How can I carry the phost field into final table after the lookup?

 do something...
     | table puser phost earliest latest
     | map search="search index=winevents src_ip=$phost$ earliest=$earliest$ latest=$latest$ | eval puser=$puser$ | eval phost=$phost$ | head 1" maxsearches=100
     | table puser phost
      | lookup user_info account_name AS user OUTPUT ....
0 Karma

woodcock
Esteemed Legend

You should probably change src_ip=$phost$ to either src=$phost$ or host=$phost$ or similar. It seems exceedingly unlikely that a field called src_ip would contain anything other than an IP address.

View solution in original post

brdr
Contributor

sorry that was a typo on my part. the field in the index is src. good catch. however, the problem still remains that phost is not displaying host names just IP. The work around is to table src, not phost.

thank you

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.