Splunk Search

map value not passing

himanshu_mps
Loves-to-Learn Everything

Hi,

I have a query which returns around 4000 results and I want to run map query for all that 4000 results. This is the query but it doesn't return any results. Individual query are working fine.

index=xxxxx_xxxxx2_idx ns=yyy-yyyy xxxx-t1-* totalDuration 
| spath input=message output=overallTimeTaken path=totalDuration 
| where overallTimeTaken > 226 
| spath input=message output=yyy-yyyy-correlation-id-var path=yyy-yyyy-correlation-id 
| map search="search index=xxxxx_xxxxx2_idx ns=xxxx-api-v4 app_name=xxxxarngs-* xxxxRequestLoggingHandlerImpl $yyy-yyyy-correlation-id-var$ 
| head 1
| eval arngServerTimeTaken=mvindex(split(_raw," "),-2) 
| eval id=mvindex(split(_raw," "),-8) 
| stats id, max(arngServerTimeTaken) as arngServerTimeTaken 
| appendcols 
    [ search index=xxxxx_xxxxx2_idx ns=xxxx-api-v4 app_name=xxxxtranslation-* xxxxRequestLoggingHandlerImpl $yyy-yyyy-correlation-id-var$
	| head 1
    | eval translationServerTimeTaken=mvindex(split(_raw," "),-2) 
    | stats max(translationServerTimeTaken) as translationServerTimeTaken]" maxsearches=0 
| table id, arngServerTimeTaken

 

The yyy-yyyy-correlation-id-var will be around 4000 from the first query which is going as an input to map. I need to make it work from map/multisearch as I have 10 other columns that I want to add to the result from other search queries.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...