Old topic but someone may find it via google looking for a solution. For me saved search with map command, to which $variable$ is passed worked in the following way... savedsearch_1: foo | map savedsearch_2 var1=$var1$ var2=$var2$ savedsearch_2: search bar | where var1=$var1$ var2=$var2$ | head 1 Trying different syntax like: foo | map search="search bar | where var1=\"$var1\" var2=\"var2\" | head 1" worked well in interactive search but on saved and scheduled the variables weren't passed to the map command so the search always was returning no results. ... View more

Old topic but someone may find it via google looking for a solution. For me saved search with map command, to which $variable$ is passed worked in the following way... savedsearch_1: foo | map savedsearch_2 var1=$var1$ var2=$var2$ savedsearch_2: search bar | where var1=$var1$ var2=$var2$ | head 1 Trying different syntax like: foo | map search="search bar | where var1=\"$var1\" var2=\"var2\" | head 1" worked well in interactive search but on saved and scheduled the variables weren't passed to the map command so the search always was returning no results. ... View more