Splunk Search

map command with functions

maramel
Engager

I'm trying to use the map command and it seems to fail when I try using some functions within the subsearch (specifically: cidrmatch()). 

 

This search returns a correctly-populated table of all the fields except for the "matches" field which is just empty 


index=my_index earliest=-5m
| table _time src_ip
| map search=" | search index=my_other_index  earliest=-6h | rename id as id2 | dedup id2 | eval searchip=$src_ip$ | eval matches=if(cidrmatch(cidr_block, searchip), "true", "false") | table id2 searchip matches cidr_block"


Note: my goal is to join two searches but not based on a common field, based on cidrmatching ips from one search to the cidrblocks in the other. I don't want to use lookup tables as I want both to be dynamic. 

Labels (1)
0 Karma
1 Solution

IZ88
Path Finder

Hi @maramel 

Since map uses quotation marks, you must use \ for all special characters within you search.

| map search=" | search index=my_other_index  earliest=-6h | rename id as id2 | dedup id2 | eval searchip=$src_ip$ | eval matches=if(cidrmatch(cidr_block, searchip), \"true\", \"false\") | table id2 searchip matches cidr_block"

View solution in original post

IZ88
Path Finder

Hi @maramel 

Since map uses quotation marks, you must use \ for all special characters within you search.

| map search=" | search index=my_other_index  earliest=-6h | rename id as id2 | dedup id2 | eval searchip=$src_ip$ | eval matches=if(cidrmatch(cidr_block, searchip), \"true\", \"false\") | table id2 searchip matches cidr_block"

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...