Splunk Search

Does the map command support real-time search and is it streaming?

spyme72
Path Finder

I am trying to use the map command to trigger a new search each time a new event comes through to Splunk. The new search would be a saved search which triggers an email.

The whole search works for the initial set of data in the index, but when new data comes in, the saved search is not triggered. Does the map command support real-time search and is it streaming?

search

index=abc |fields to,subject,message
|map savedsearchabc

saved search

|sendemail to="$Address$" subject="$msg$" message="$msg$

curtisb1024
Path Finder

From the comments in this answer, it appears that map doesn't start it's search until the outer search completes. Because a real-time search never completes, the search triggered by the map command never runs.

So, no. Unfortunately the map command is not supported in real-time searches.

satishsdange
Builder

Hi -

Could you please let us know time is spent on running 1st search by looking at Job inspector?
There could be possibility that saved search is not getting triggered. Information about skipped searches could be found from scheduler.log

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...