Splunk Search

What's wrong with this map search command

raoul
Path Finder

I am battling with the use of the map search command.

I have some queries that work fine by themselves, but when I try and combine them I get an error in the form: "Unable to run query XXX"

However, if I copy the quoted query that Splunk is "unable to run" and paste it into a new search by itself it runs without any problems.

The command I am using is:

sourcetype="WinEventLog:Application" "not known to the TermApp" | rex field=_raw "terminal ID (?<TID>.*) is not known" | lookup terminal_lookup TID OUTPUT PTID | stats count by PTID | search count>50 | map maxsearches=17 search="sourcetype="vc_termlog" TermID=$PTID$"

The edited down essence of this really:

<some search> | stats count by PTID | map maxsearches=17 search="sourcetype="vc_termlog" TermID=$PTID$"

The specific error I get is:

Unable to run query 'sourcetype=vc_termlog TermID=15157736'.

However when I run the query quoted in a separate search window it runs perfectly.

I have tried with and without maxsearches.

Tags (2)
0 Karma
1 Solution

carasso
Splunk Employee
Splunk Employee

Look at this snippet of your search:

... search="sourcetype="vc_termlog" TermID=$PTID$"

Look at the quoting! That's

... search="sourcetype="       vc_termlog      " TermID=$PTID$"

Now you see the problem? Also, I think your search needs to start with "search"

Try

... search="search sourcetype=vc_termlog TermID=$PTID$"

Or use the subsearch notation for map:

| map maxsearches=17 [search sourcetype="vc_termlog" TermID=$PTID$]

View solution in original post

carasso
Splunk Employee
Splunk Employee

Look at this snippet of your search:

... search="sourcetype="vc_termlog" TermID=$PTID$"

Look at the quoting! That's

... search="sourcetype="       vc_termlog      " TermID=$PTID$"

Now you see the problem? Also, I think your search needs to start with "search"

Try

... search="search sourcetype=vc_termlog TermID=$PTID$"

Or use the subsearch notation for map:

| map maxsearches=17 [search sourcetype="vc_termlog" TermID=$PTID$]

gkanapathy
Splunk Employee
Splunk Employee

It would be helpful to see the exact map command as well as the query.

0 Karma

raoul
Path Finder

Done, command added to question

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...