Splunk Search
Highlighted

map question

Contributor

I'm getting some strange results with the map command. This is what I need to do... in one index (1st search) I have 'action' , 'host', and 'time' field. The other search (2nd search) is used in the map using fields 'user' and 'time'. I need to extract the field 'user' where the '_time' fields are very close together (few minutes) in both indexes. My result when I run the search I get duplicate rows and more events. Thanks for your help.

|index=myindex1 
| eval my_earliest=_time
| eval my_latest=relative_time(_time, "+3m")
| sort _time
| table action host my_earliest my_latest
| map search="search index=myindex2 (_time > my_earliest AND _time < my_latest) | dedup user | sort _time |eval action=$action$, host=$host$" maxsearches=500
| table user action host _time
Tags (1)
0 Karma
Highlighted

Re: map question

Contributor

i forgot the '$' around the my earliest and latest variables in the search.. doh.

0 Karma