Hey all,
I have a search that uses the map command. It looks like:
<myBaseSearch>
| map [search index=main sourcetype=perfLogging userID=$userId$ splunk_server=$splunk_server$]
The resulting table displays a bunch of fields that aren't part of the perfLogging sourcetype; they are part of other sourcetypes in the main index though. These fields are empty, which leads me to believe the search is correct, but I am curious...
Is this expected behavior for the map command? In other words, should the resulting table have a column for all fields discovered in the index?
I've found the generic display of results after map
weird at times - but you can rely on any computation done afterwards to be correct, for example a stats
applied to the results.
Why are you using map
for that though? It seems to me as if you could just use the base search as a subsearch producing a large filter in the now mapped search.
I've found the generic display of results after map
weird at times - but you can rely on any computation done afterwards to be correct, for example a stats
applied to the results.
Why are you using map
for that though? It seems to me as if you could just use the base search as a subsearch producing a large filter in the now mapped search.
Ah, I see. In that case using map
likely is the way to go.
Sorry, I didn't post the complete search. The base search actually provides time constraints for the mapped search.
Also, we are going to do more computation on the results, but I noticed the weird display first and wanted to see if anyone else saw this issue.
Thanks for the explanation.