Splunk Search
Highlighted

map command not working

New Member

Hi All,

when I am trying to run the subsearch separately, I am getting values. But when I am using map to run the below query, I am not getting any results.

sourcetype="pega17052017n" QI-535653 OR QI-535654|stats values(WOID) as val|table val|map search="[search sourcetype=\"QI-535653\" QI-* val=$val$|stats values(sessionid) by val" maxsearches=10

Can you please help?

Thanks and regards,
Arjit goswami.

0 Karma
Highlighted

Re: map command not working

Super Champion

this question was asked earlier. https://answers.splunk.com/answers/542641/map-command-in-splunk.html for reference.

0 Karma
Highlighted

Re: map command not working

Legend

@arjitgoswami, you r base search is returning multi-value result. Try the following:

sourcetype="pega17052017n" QI-535653 OR QI-535654
| stats count by WOID
| rename WOID as val
| table val
| map search="search sourcetype=\"QI-535653\" QI-* val=$val$
                          | stats values(sessionid) by val" maxsearches=10



| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: map command not working

Esteemed Legend

Try this:

sourcetype="pega17052017n" QI-535653 OR QI-535654|stats values(WOID) as val
| table val
| map maxsearches=10 search="search sourcetype=\"QI-535653\" QI-* val=$val$|stats values(sessionid) by val"

They key is removing the extra [ character.

0 Karma
Highlighted

Re: map command not working

New Member

Thanks a lot @niketnilay. Its worked !!

0 Karma