Splunk Search

Appending a field returned from map?

oclumbertruck
Explorer

Howdy folks, I have a question around using map.

I have a large query that essentially generate the the following table:

id, title, stuff
1, title-1, stuff-1
2, title-2, stuff-2
3, title-3, stuff-3

I have a macro that takes an id, does some computation and applies a ML (Machine Learning) model and spits out a field, all by itself called "data". Due to the transforms and computations applied in the macro, the id is not retained, solely the "data" field.

I'm experimenting with map, to try and pass $id$ to the macro, and append the "data" field to the table. It appears map has a hard time interpreting $id$ unless I use appendpipe to the following tune:

\previous search\ | table id title stuff | appendpipe [ map [ search \`myMacro($id$)\`]]

which outputs this :
id, title, stuff, data
1, title-1, stuff-1,
2, title-2, stuff-2,
3, title-3, stuff-3,
, , , data-1
, , , data-2
, , , data-3

So rather than the field being appended to the current row, it seems to be getting appended to the bottom of the table. I realize that if the macro would return the id, that stats would probably fix this, however, this is the challenge.... Any help would be appreciated, I've gone back and forth with trying to make map search=search... vs appendpipe and can't seem to get the return of the macro to append as a column inline as opposed to new rows....

Thanks...

Tags (3)
1 Solution

woodcock
Esteemed Legend

Try this:

\previous search\
| fields id title stuff
| multireport [ table id title stuff ]
              [ map search="search `myMacro($id$)` | eval id=$id$" ]
| stats values(*) AS * BY id

View solution in original post

woodcock
Esteemed Legend

Try this:

\previous search\
| fields id title stuff
| multireport [ table id title stuff ]
              [ map search="search `myMacro($id$)` | eval id=$id$" ]
| stats values(*) AS * BY id

oclumbertruck
Explorer

This was super close out of the box, and ultimately got me to where i need to be. In the macro, I added a | eval id="$id$" right before the model is applied. It seems that if I tried eval statements after the model apply, the new fields would not be created....

The double quotes were the stingers as well, those got me. So, being able to add the eval in the macro, means I didn't need the eval statement in the map portion, and everything is working great now. Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...