Hi Splunk Community, I have created the following SPL for scheduled alerts. Some parts are masked for confidentiality, but the structure is as follows: | inputlookup my_lookup_table | eval chk_ignore_from=if(Ignore_From!="", strptime(Ignore_From,"%Y/%m/%d %H:%M:%S"), null()) | eval chk_ignore_to =if(Ignore_To!="", strptime(Ignore_To,"%Y/%m/%d %H:%M:%S"), null()) | where isnull(chk_ignore_from) OR isnull(chk_ignore_to) OR (now() < chk_ignore_from OR now() >= chk_ignore_to) | where isnotnull(Macro) AND Macro!="" AND isnotnull(Alert_Mail_Send_To) AND Alert_Mail_Send_To!="" AND isnotnull(Alert_Mail_Title) AND Alert_Mail_Title!="" AND isnotnull(Alert_Mail_Body) AND Alert_Mail_Body!="" | eval Macro=trim(Macro) | eval Macro=case(match(Macro,"^[\"'].*[\"']$"), substr(Macro,2,len(Macro)-2), true(), Macro) | map maxsearches=500 search="search `$Macro$` | fields _time _raw host | eval target_host=\"...\", Alert_Mail_Send_To=\"...\", Alert_Mail_Title=\"...\", Alert_Mail_Body=\"...\", Macro=\"$Macro$\" | fields _time _raw host Alert_Mail_Send_To Alert_Mail_Title Alert_Mail_Body Macro target_host" | dedup Alert_Mail_Body My main concern is the use of the map command. I know map can be risky because it runs multiple searches and could cause performance issues if not controlled properly. Questions: Are there best practices for using map in scheduled searches to avoid excessive search executions? Besides maxsearches, is there any recommended way to limit or safeguard map usage in Splunk Cloud? From a long-term operation perspective, do you see any potential issues with this SPL design? Any feedback or suggestions would be greatly appreciated!
... View more
