Splunk Search

map command not working

arjitgoswami
Explorer

Hi All,

when I am trying to run the subsearch separately, I am getting values. But when I am using map to run the below query, I am not getting any results.

sourcetype="pega17052017n" QI-535653 OR QI-535654|stats values(WOID) as val|table val|map search="[search sourcetype=\"QI-535653\" QI-* val=$val$|stats values(sessionid) by val" maxsearches=10

Can you please help?

Thanks and regards,
Arjit goswami.

0 Karma

arjitgoswami
Explorer

Thanks a lot @niketnilay. Its worked !!

0 Karma

woodcock
Esteemed Legend

Try this:

sourcetype="pega17052017n" QI-535653 OR QI-535654|stats values(WOID) as val
| table val
| map maxsearches=10 search="search sourcetype=\"QI-535653\" QI-* val=$val$|stats values(sessionid) by val"

They key is removing the extra [ character.

0 Karma

niketn
Legend

@arjitgoswami, you r base search is returning multi-value result. Try the following:

sourcetype="pega17052017n" QI-535653 OR QI-535654
| stats count by WOID
| rename WOID as val
| table val
| map search="search sourcetype=\"QI-535653\" QI-* val=$val$
                          | stats values(sessionid) by val" maxsearches=10
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cmerriman
Super Champion

this question was asked earlier. https://answers.splunk.com/answers/542641/map-command-in-splunk.html for reference.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...