Splunk Search

map command

kgrahamLM
Observer

Can I use the map command with the variable being the index and/or sourcetype?

| makeresults
| eval User = "12345", index = "index=_audit"
| table User, index 
| map search="search $index$ user="$User$"
| table field_1, field_2"

0 Karma

richgalloway
SplunkTrust
SplunkTrust
If the field exists prior to the map command then you should be able to use it within the command. Have you tried it?
---
If this reply helps you, Karma would be appreciated.
0 Karma

kgrahamLM
Observer

The field 'index' exists and contains 'index=_audit', however, it won't render.  I get an error message.  

0 Karma

richgalloway
SplunkTrust
SplunkTrust
What is the error message?
---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

In checking the search log, I see this

07-30-2020 15:48:30.388 INFO  SearchParser - PARSING: search "index=_audit" user=admin savedsearch_name=*\n| where len(savedsearch_name) > 1\n| eval User = admin, LogSource = "index=_audit"\n| table LogSource, savedsearch_name, _time, user

It would appear that the $index$ token is being used literally, including the quotation marks.  That, of course, breaks the search.

Why can you not put index=$index$ in map and set the token to the index name? 

---
If this reply helps you, Karma would be appreciated.
0 Karma

kgrahamLM
Observer

I can't hardcode index because sometimes I will be looking for different variations like: index only or index and sourcetype.  Is there a way to escape the quote within the map command?

0 Karma

richgalloway
SplunkTrust
SplunkTrust
I was unable to find a way to suppress or escape the quotation marks. IMO, the presence of quotation marks in the parsed search is a bug. Consider submitting a support request to Splunk.
---
If this reply helps you, Karma would be appreciated.
0 Karma

kgrahamLM
Observer

When testing..... I hard coded 'index=_audit" and the results rendered.  (see below)

| makeresults
| eval User = "1234", index = "index=_audit"
| table User, index
`comment(" -------------------- GET LIST OF JOBS THAT RAN FOR THIS USER -------------------- ")`
| map search="search index=_audit user="$User$" savedsearch_name=*
| where len(savedsearch_name) > 1
| eval User = "$User$",
            LogSource = "$index$"
| table LogSource, User, savedsearch_name, _time, user "

LogSource outputs: index=_audit
but
User does NOT output 1234

Can't think of why!

Then I replace the hardcoded index with the variable and it returns 0 results.
| makeresults
| eval User = "1234", index = "index=_audit"
| table User, index
`comment(" -------------------- GET LIST OF JOBS THAT RAN FOR THIS USER -------------------- ")`
| map search="search $index$ user="$User$" savedsearch_name=*
| where len(savedsearch_name) > 1
| eval User = "$User$", LogSource = "$index$"
| table LogSource, User, savedsearch_name, _time, user "

Is there something wrong with my syntax?  If I get it working I plan on substituting the | makeresults with a lookup to get multiple items.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...