map command not working

[arjitgoswami]

Hi All,

when I am trying to run the subsearch separately, I am getting values. But when I am using map to run the below query, I am not getting any results.

sourcetype="pega17052017n" QI-535653 OR QI-535654|stats values(WOID) as val|table val|map search="[search sourcetype=\"QI-535653\" QI-* val=$val$|stats values(sessionid) by val" maxsearches=10

Can you please help?

Thanks and regards,
Arjit goswami.

[cmerriman]

this question was asked earlier. https://answers.splunk.com/answers/542641/map-command-in-splunk.html for reference.

[niketnilay]

@arjitgoswami, you r base search is returning multi-value result. Try the following:

sourcetype="pega17052017n" QI-535653 OR QI-535654
| stats count by WOID
| rename WOID as val
| table val
| map search="search sourcetype=\"QI-535653\" QI-* val=$val$
                          | stats values(sessionid) by val" maxsearches=10

[woodcock]

Try this:

sourcetype="pega17052017n" QI-535653 OR QI-535654|stats values(WOID) as val
| table val
| map maxsearches=10 search="search sourcetype=\"QI-535653\" QI-* val=$val$|stats values(sessionid) by val"

They key is removing the extra [ character.

[arjitgoswami]

Thanks a lot @niketnilay. Its worked !!