Map is like a foreach iterator. It will take each "result" of a previous search, and perform the map search that many times with the specified map search. An example might help.
So I have a search (let's call it SRCH_1 ) " sourcetype=syslog sudo|stats count by user host "
This returns a table such as:
user host count
user1 server1 1
user3 server1 3
user1 server3 2
Right after SRCH_1 , we will pipe, and then add the map command ( SRCH_MAP it shall be known as): |map search="search index=ad_summary username=$user$ type_logon=ad_last_logon" . This command will take each of the three results above, and search in my ad_summary index for a user logon event. The results are returned as a table and look like this(ish):
_time computername computertime username usertime
10/12/12 8:31:35.00 AM ADMIN28-H$ 10/12/2012 08:25:42 user1 10/12/2012 08:31:35 AM
What this is doing, putting it together, is finding who sudo'd and then tracing back to the computer and time they logged on to prior to the sudo event.
EDIT:
Here is the complete search:
sourcetype=syslog sudo|stats count by user host|map search="search index=ad_summary username=$user$ type_logon=ad_last_logon"
... View more
