Splunk Search

How can I pass a default value to the map command?

caili
Path Finder

My searce Query is:

index=ies_log ruleid=50513 earliest=-7d@d|eval start_time=relative_time(date,"-5m@m")|eval start_time=strftime(start_time, "%m/%d/%Y:%H:%M:%S")|eval end_time=strftime(date, "%m/%d/%Y:%H:%M:%S" )|fields start_time,end_time,sip,dip,dport |map search="search index=ies_log ruleid=20347 earliest=$start_time$ latest=$end_time$ sip=$sip$ dip=$dip$ dport=$dport$" maxsearches=10000|stats dc(dip)

If no event found before map command, then all the arguments have no value passed,
and the error is:
Error in 'map': Did not find value for required attribute 'st'.

Can I pass a default value to the command? How?

Tags (3)
1 Solution

woodcock
Esteemed Legend

You can do it like this (but I don't know why you would like to do so):

index=ies_log ruleid=50513 earliest=-7d@d|eval start_time=relative_time(date,"-5m@m")|eval start_time=strftime(start_time, "%m/%d/%Y:%H:%M:%S")|eval end_time=strftime(date, "%m/%d/%Y:%H:%M:%S" ) | append [|noop | stats count AS sip| eval start_time=DEFAULT | eval end_time=DEFAULT | eval sip=DEFAULT | eval dip=DEFAULT | eval dport = DEFAULT] |fields start_time,end_time,sip,dip,dport |map search="search index=ies_log ruleid=20347 earliest=$start_time$ latest=$end_time$ sip=$sip$ dip=$dip$ dport=$dport$" maxsearches=10000|stats dc(dip)

It is not exactly what you asked, though, because the default will always run as the last map.

View solution in original post

woodcock
Esteemed Legend

You can do it like this (but I don't know why you would like to do so):

index=ies_log ruleid=50513 earliest=-7d@d|eval start_time=relative_time(date,"-5m@m")|eval start_time=strftime(start_time, "%m/%d/%Y:%H:%M:%S")|eval end_time=strftime(date, "%m/%d/%Y:%H:%M:%S" ) | append [|noop | stats count AS sip| eval start_time=DEFAULT | eval end_time=DEFAULT | eval sip=DEFAULT | eval dip=DEFAULT | eval dport = DEFAULT] |fields start_time,end_time,sip,dip,dport |map search="search index=ies_log ruleid=20347 earliest=$start_time$ latest=$end_time$ sip=$sip$ dip=$dip$ dport=$dport$" maxsearches=10000|stats dc(dip)

It is not exactly what you asked, though, because the default will always run as the last map.

caili
Path Finder

U resolved my question, thanks!

I can pass an invalid data to the arguments, so the last map can't search it.

If no default value given, then no event whose ruleid is 50513 is found, the search report error, but i want it returns 0.

0 Karma

woodcock
Esteemed Legend

OK, so you have what you need then? If so, be sure to close the question by clicking "Accept".

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...