Splunk Search

map command with functions

maramel
Engager

I'm trying to use the map command and it seems to fail when I try using some functions within the subsearch (specifically: cidrmatch()). 

 

This search returns a correctly-populated table of all the fields except for the "matches" field which is just empty 


index=my_index earliest=-5m
| table _time src_ip
| map search=" | search index=my_other_index  earliest=-6h | rename id as id2 | dedup id2 | eval searchip=$src_ip$ | eval matches=if(cidrmatch(cidr_block, searchip), "true", "false") | table id2 searchip matches cidr_block"


Note: my goal is to join two searches but not based on a common field, based on cidrmatching ips from one search to the cidrblocks in the other. I don't want to use lookup tables as I want both to be dynamic. 

Labels (1)
0 Karma
1 Solution

IZ88
Path Finder

Hi @maramel 

Since map uses quotation marks, you must use \ for all special characters within you search.

| map search=" | search index=my_other_index  earliest=-6h | rename id as id2 | dedup id2 | eval searchip=$src_ip$ | eval matches=if(cidrmatch(cidr_block, searchip), \"true\", \"false\") | table id2 searchip matches cidr_block"

View solution in original post

IZ88
Path Finder

Hi @maramel 

Since map uses quotation marks, you must use \ for all special characters within you search.

| map search=" | search index=my_other_index  earliest=-6h | rename id as id2 | dedup id2 | eval searchip=$src_ip$ | eval matches=if(cidrmatch(cidr_block, searchip), \"true\", \"false\") | table id2 searchip matches cidr_block"

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!