Splunk Search

How can I pass a default value to the map command?

caili
Path Finder

My searce Query is:

index=ies_log ruleid=50513 earliest=-7d@d|eval start_time=relative_time(date,"-5m@m")|eval start_time=strftime(start_time, "%m/%d/%Y:%H:%M:%S")|eval end_time=strftime(date, "%m/%d/%Y:%H:%M:%S" )|fields start_time,end_time,sip,dip,dport |map search="search index=ies_log ruleid=20347 earliest=$start_time$ latest=$end_time$ sip=$sip$ dip=$dip$ dport=$dport$" maxsearches=10000|stats dc(dip)

If no event found before map command, then all the arguments have no value passed,
and the error is:
Error in 'map': Did not find value for required attribute 'st'.

Can I pass a default value to the command? How?

Tags (3)
1 Solution

woodcock
Esteemed Legend

You can do it like this (but I don't know why you would like to do so):

index=ies_log ruleid=50513 earliest=-7d@d|eval start_time=relative_time(date,"-5m@m")|eval start_time=strftime(start_time, "%m/%d/%Y:%H:%M:%S")|eval end_time=strftime(date, "%m/%d/%Y:%H:%M:%S" ) | append [|noop | stats count AS sip| eval start_time=DEFAULT | eval end_time=DEFAULT | eval sip=DEFAULT | eval dip=DEFAULT | eval dport = DEFAULT] |fields start_time,end_time,sip,dip,dport |map search="search index=ies_log ruleid=20347 earliest=$start_time$ latest=$end_time$ sip=$sip$ dip=$dip$ dport=$dport$" maxsearches=10000|stats dc(dip)

It is not exactly what you asked, though, because the default will always run as the last map.

View solution in original post

woodcock
Esteemed Legend

You can do it like this (but I don't know why you would like to do so):

index=ies_log ruleid=50513 earliest=-7d@d|eval start_time=relative_time(date,"-5m@m")|eval start_time=strftime(start_time, "%m/%d/%Y:%H:%M:%S")|eval end_time=strftime(date, "%m/%d/%Y:%H:%M:%S" ) | append [|noop | stats count AS sip| eval start_time=DEFAULT | eval end_time=DEFAULT | eval sip=DEFAULT | eval dip=DEFAULT | eval dport = DEFAULT] |fields start_time,end_time,sip,dip,dport |map search="search index=ies_log ruleid=20347 earliest=$start_time$ latest=$end_time$ sip=$sip$ dip=$dip$ dport=$dport$" maxsearches=10000|stats dc(dip)

It is not exactly what you asked, though, because the default will always run as the last map.

caili
Path Finder

U resolved my question, thanks!

I can pass an invalid data to the arguments, so the last map can't search it.

If no default value given, then no event whose ruleid is 50513 is found, the search report error, but i want it returns 0.

0 Karma

woodcock
Esteemed Legend

OK, so you have what you need then? If so, be sure to close the question by clicking "Accept".

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...