Splunk Search

passing previous result fields to localize and map

cphair
Builder

Say I have a search like this, trying to find all the events that occurred on hosts around the some_text event:


index=_internal host=host1 OR host=host2 source=splunkd.log some_text | localize | map search="search index=_internal"

How do I tell localize and map to only search over the hosts that matched in the original search? I tried adding host=$host$ to the map search, as the documentation indicates, but I get the error that it did not find value for required attribute host. Will the syntax change if I use it in a dashboard?

Tags (3)
0 Karma
1 Solution

cvaudo
Engager

I managed to do this by just recreating the behavior of localize function manually


| eval eventTimeMinusX=_time-60
| eval eventTimePlusX=_time+60
| map search="search sourcetype=WinEventLog:Application host=$host$ _time>=$eventTimeMinusX$ _time<=$eventTimePlusX$" maxsearches=100
| sort host, _time

View solution in original post

cvaudo
Engager

I managed to do this by just recreating the behavior of localize function manually


| eval eventTimeMinusX=_time-60
| eval eventTimePlusX=_time+60
| map search="search sourcetype=WinEventLog:Application host=$host$ _time>=$eventTimeMinusX$ _time<=$eventTimePlusX$" maxsearches=100
| sort host, _time

chris
Motivator

Hi cphair

I think, the problem ist that you loose the information from your base search when you pipe to localize so there is no host field left for the map command. If you already know which hosts you are looking for in the base search you can reuse them in the map search.

I used sourcetype instead of host in this example:

index=_internal source=*splunkd.log (sourcetype=splunkd OR sourcetype=scheduler)  | localize | map search="search index=_internal (sourcetype=splunkd OR sourcetype=scheduler)  starttimeu=$starttime$ endtimeu=$endtime$" 

You have to decide whether you want to loop over a list of hosts or a list of time ranges with the map command. But maybe I misunderstood your question

0 Karma

cphair
Builder

No, I never did. It wasn't a hard requirement, so I let it go.

0 Karma

anandhim
Path Finder

@cphair: Did you fid any workarounds for this or another apporach? I have a similar issue.

0 Karma

cphair
Builder

That's the problem, though--I don't know which hosts were found by the base search. It may be that only one host matched, in which case I'm not interested in any events around that time from the other host. So localize can't handle that?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...