Splunk Search

map command not working

arjitgoswami
Explorer

Hi All,

when I am trying to run the subsearch separately, I am getting values. But when I am using map to run the below query, I am not getting any results.

sourcetype="pega17052017n" QI-535653 OR QI-535654|stats values(WOID) as val|table val|map search="[search sourcetype=\"QI-535653\" QI-* val=$val$|stats values(sessionid) by val" maxsearches=10

Can you please help?

Thanks and regards,
Arjit goswami.

0 Karma

arjitgoswami
Explorer

Thanks a lot @niketnilay. Its worked !!

0 Karma

woodcock
Esteemed Legend

Try this:

sourcetype="pega17052017n" QI-535653 OR QI-535654|stats values(WOID) as val
| table val
| map maxsearches=10 search="search sourcetype=\"QI-535653\" QI-* val=$val$|stats values(sessionid) by val"

They key is removing the extra [ character.

0 Karma

niketn
Legend

@arjitgoswami, you r base search is returning multi-value result. Try the following:

sourcetype="pega17052017n" QI-535653 OR QI-535654
| stats count by WOID
| rename WOID as val
| table val
| map search="search sourcetype=\"QI-535653\" QI-* val=$val$
                          | stats values(sessionid) by val" maxsearches=10
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cmerriman
Super Champion

this question was asked earlier. https://answers.splunk.com/answers/542641/map-command-in-splunk.html for reference.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...