I am trying to use the map command to trigger a new search each time a new event comes through to Splunk. The new search would be a saved search which triggers an email.
The whole search works for the initial set of data in the index, but when new data comes in, the saved search is not triggered. Does the map command support real-time search and is it streaming?
search
index=abc |fields to,subject,message
|map savedsearchabc
saved search
|sendemail to="$Address$" subject="$msg$" message="$msg$
From the comments in this answer, it appears that map
doesn't start it's search until the outer search completes. Because a real-time search never completes, the search triggered by the map
command never runs.
So, no. Unfortunately the map
command is not supported in real-time searches.
Hi -
Could you please let us know time is spent on running 1st search by looking at Job inspector?
There could be possibility that saved search is not getting triggered. Information about skipped searches could be found from scheduler.log