Splunk Search

How can I pass a default value to the map command?

caili
Path Finder

My searce Query is:

index=ies_log ruleid=50513 earliest=-7d@d|eval start_time=relative_time(date,"-5m@m")|eval start_time=strftime(start_time, "%m/%d/%Y:%H:%M:%S")|eval end_time=strftime(date, "%m/%d/%Y:%H:%M:%S" )|fields start_time,end_time,sip,dip,dport |map search="search index=ies_log ruleid=20347 earliest=$start_time$ latest=$end_time$ sip=$sip$ dip=$dip$ dport=$dport$" maxsearches=10000|stats dc(dip)

If no event found before map command, then all the arguments have no value passed,
and the error is:
Error in 'map': Did not find value for required attribute 'st'.

Can I pass a default value to the command? How?

Tags (3)
1 Solution

woodcock
Esteemed Legend

You can do it like this (but I don't know why you would like to do so):

index=ies_log ruleid=50513 earliest=-7d@d|eval start_time=relative_time(date,"-5m@m")|eval start_time=strftime(start_time, "%m/%d/%Y:%H:%M:%S")|eval end_time=strftime(date, "%m/%d/%Y:%H:%M:%S" ) | append [|noop | stats count AS sip| eval start_time=DEFAULT | eval end_time=DEFAULT | eval sip=DEFAULT | eval dip=DEFAULT | eval dport = DEFAULT] |fields start_time,end_time,sip,dip,dport |map search="search index=ies_log ruleid=20347 earliest=$start_time$ latest=$end_time$ sip=$sip$ dip=$dip$ dport=$dport$" maxsearches=10000|stats dc(dip)

It is not exactly what you asked, though, because the default will always run as the last map.

View solution in original post

woodcock
Esteemed Legend

You can do it like this (but I don't know why you would like to do so):

index=ies_log ruleid=50513 earliest=-7d@d|eval start_time=relative_time(date,"-5m@m")|eval start_time=strftime(start_time, "%m/%d/%Y:%H:%M:%S")|eval end_time=strftime(date, "%m/%d/%Y:%H:%M:%S" ) | append [|noop | stats count AS sip| eval start_time=DEFAULT | eval end_time=DEFAULT | eval sip=DEFAULT | eval dip=DEFAULT | eval dport = DEFAULT] |fields start_time,end_time,sip,dip,dport |map search="search index=ies_log ruleid=20347 earliest=$start_time$ latest=$end_time$ sip=$sip$ dip=$dip$ dport=$dport$" maxsearches=10000|stats dc(dip)

It is not exactly what you asked, though, because the default will always run as the last map.

caili
Path Finder

U resolved my question, thanks!

I can pass an invalid data to the arguments, so the last map can't search it.

If no default value given, then no event whose ruleid is 50513 is found, the search report error, but i want it returns 0.

0 Karma

woodcock
Esteemed Legend

OK, so you have what you need then? If so, be sure to close the question by clicking "Accept".

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...