Say I have a search like this, trying to find all the events that occurred on hosts around the sometext event:
internal host=host1 OR host=host2 source=splunkd.log sometext | localize | map search="search index=internal"
I think, the problem ist that you loose the information from your base search when you pipe to localize so there is no host field left for the map command. If you already know which hosts you are looking for in the base search you can reuse them in the map search.
I used sourcetype instead of host in this example:
index=_internal source=*splunkd.log (sourcetype=splunkd OR sourcetype=scheduler) | localize | map search="search index=_internal (sourcetype=splunkd OR sourcetype=scheduler) starttimeu=$starttime$ endtimeu=$endtime$"
You have to decide whether you want to loop over a list of hosts or a list of time ranges with the map command. But maybe I misunderstood your question
That's the problem, though--I don't know which hosts were found by the base search. It may be that only one host matched, in which case I'm not interested in any events around that time from the other host. So localize can't handle that?
I managed to do this by just recreating the behavior of localize function manually
| eval eventTimeMinusX=time-60
| eval eventTimePlusX=time+60
| map search="search sourcetype=WinEventLog:Application host=$host$ _time>=$eventTimeMinusX$ _time<=$eventTimePlusX$" maxsearches=100
| sort host, _time