Splunk Search

What fields are displayed when using the "map" command

bruceclarke
Contributor

Hey all,

I have a search that uses the map command. It looks like:

<myBaseSearch>
| map [search index=main sourcetype=perfLogging userID=$userId$ splunk_server=$splunk_server$]

The resulting table displays a bunch of fields that aren't part of the perfLogging sourcetype; they are part of other sourcetypes in the main index though. These fields are empty, which leads me to believe the search is correct, but I am curious...

Is this expected behavior for the map command? In other words, should the resulting table have a column for all fields discovered in the index?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I've found the generic display of results after map weird at times - but you can rely on any computation done afterwards to be correct, for example a stats applied to the results.

Why are you using map for that though? It seems to me as if you could just use the base search as a subsearch producing a large filter in the now mapped search.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

I've found the generic display of results after map weird at times - but you can rely on any computation done afterwards to be correct, for example a stats applied to the results.

Why are you using map for that though? It seems to me as if you could just use the base search as a subsearch producing a large filter in the now mapped search.

martin_mueller
SplunkTrust
SplunkTrust

Ah, I see. In that case using map likely is the way to go.

0 Karma

bruceclarke
Contributor

Sorry, I didn't post the complete search. The base search actually provides time constraints for the mapped search.

Also, we are going to do more computation on the results, but I noticed the weird display first and wanted to see if anyone else saw this issue.

Thanks for the explanation.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...