map command field not being evaluated

[brdr]

I have an issue with a field within the map command not being evaluated appropriately. The scenario is this:

do something...
| table puser phost earliest latest
| map search="search index=winevents src_ip=$phost$ earliest=$earliest$ latest=$latest$ | eval puser=$puser$ | eval phost=$phost$ | head 1" maxsearches=100
| table puser phost

The issue is that 'phost' will display results only when the phost is an ip address. If the 'phost' value is a host name it will not display. Any idea why? NOTE: when I display the puser, phost via the first table command i get host name values. Only when map command runs do the host names not display in the second table command.

[woodcock]

You are either running in Fast Mode instead of Smart Mode OR you may be running into this problem, depending on how your field is created:

https://www.splunk.com/blog/2011/10/07/cannot-search-based-on-an-extracted-field.html

[brdr]

Ok. i will take a look at the document. I have been running in smart mode. I have one more question if you don't mind sir. After the map command runs I table puser and phost. After that I need to perform a lookup of the puser to get the full name of the puser. And, then table puser, full name, phost. How can I carry the phost field into final table after the lookup?

 do something...
     | table puser phost earliest latest
     | map search="search index=winevents src_ip=$phost$ earliest=$earliest$ latest=$latest$ | eval puser=$puser$ | eval phost=$phost$ | head 1" maxsearches=100
     | table puser phost
      | lookup user_info account_name AS user OUTPUT ....

[woodcock · Accepted solution]

You should probably change src_ip=$phost$ to either src=$phost$ or host=$phost$ or similar. It seems exceedingly unlikely that a field called src_ip would contain anything other than an IP address.

[brdr]

sorry that was a typo on my part. the field in the index is src. good catch. however, the problem still remains that phost is not displaying host names just IP. The work around is to table src, not phost.

thank you