@woodcock : Hi Woodcock | Acknowledging your response here. Sorry was travelling so couldn't respond you yesterday. I am not sure whether my understanding is correct or not, but based on @niketnilay response on one other query, I tried to amend the given query and it started working fine. What I have done is that I have added count function and I have added one more "Search' command (based on map documentation) to our map query.
Please find the updated query below:
|makeresults
|eval QuoteID = "QI-12345,QI-67859,QI-23456,QI-57689,QI-24798"
|makemv delim="," QuoteID
|stats count by QuoteID
|map search="search sourcetype=\"Pega17052017n\" $QuoteID$
|stats count range(_time) AS TimeTaken
|eval QuoteID=\"$QuoteID$\""
|table QuoteID TimeTaken
I somehow feel that Stats(values) and table functions in base search doesn't work with Map command. Only count function in base search is sending single-valued result to map command.
Thanks a lot for your help. Much appreciated !!!
Kind regards,
Arjit Goswami
... View more