Splunk Search

passing previous result fields to localize and map

Builder

Say I have a search like this, trying to find all the events that occurred on hosts around the sometext event:


index=
internal host=host1 OR host=host2 source=splunkd.log sometext | localize | map search="search index=internal"

How do I tell localize and map to only search over the hosts that matched in the original search? I tried adding host=$host$ to the map search, as the documentation indicates, but I get the error that it did not find value for required attribute host. Will the syntax change if I use it in a dashboard?

Tags (3)
0 Karma
1 Solution

Engager

I managed to do this by just recreating the behavior of localize function manually


| eval eventTimeMinusX=time-60
| eval eventTimePlusX=
time+60
| map search="search sourcetype=WinEventLog:Application host=$host$ _time>=$eventTimeMinusX$ _time<=$eventTimePlusX$" maxsearches=100
| sort host, _time

View solution in original post

Engager

I managed to do this by just recreating the behavior of localize function manually


| eval eventTimeMinusX=time-60
| eval eventTimePlusX=
time+60
| map search="search sourcetype=WinEventLog:Application host=$host$ _time>=$eventTimeMinusX$ _time<=$eventTimePlusX$" maxsearches=100
| sort host, _time

View solution in original post

Motivator

Hi cphair

I think, the problem ist that you loose the information from your base search when you pipe to localize so there is no host field left for the map command. If you already know which hosts you are looking for in the base search you can reuse them in the map search.

I used sourcetype instead of host in this example:

index=_internal source=*splunkd.log (sourcetype=splunkd OR sourcetype=scheduler)  | localize | map search="search index=_internal (sourcetype=splunkd OR sourcetype=scheduler)  starttimeu=$starttime$ endtimeu=$endtime$" 

You have to decide whether you want to loop over a list of hosts or a list of time ranges with the map command. But maybe I misunderstood your question

0 Karma

Builder

No, I never did. It wasn't a hard requirement, so I let it go.

0 Karma

Path Finder

@cphair: Did you fid any workarounds for this or another apporach? I have a similar issue.

0 Karma

Builder

That's the problem, though--I don't know which hosts were found by the base search. It may be that only one host matched, in which case I'm not interested in any events around that time from the other host. So localize can't handle that?

0 Karma