Hi All,
when I am trying to run the subsearch separately, I am getting values. But when I am using map to run the below query, I am not getting any results.
sourcetype="pega17052017n" QI-535653 OR QI-535654|stats values(WOID) as val|table val|map search="[search sourcetype=\"QI-535653\" QI-* val=$val$|stats values(sessionid) by val" maxsearches=10
Can you please help?
Thanks and regards,
Arjit goswami.
Thanks a lot @niketnilay. Its worked !!
Try this:
sourcetype="pega17052017n" QI-535653 OR QI-535654|stats values(WOID) as val
| table val
| map maxsearches=10 search="search sourcetype=\"QI-535653\" QI-* val=$val$|stats values(sessionid) by val"
They key is removing the extra [
character.
@arjitgoswami, you r base search is returning multi-value result. Try the following:
sourcetype="pega17052017n" QI-535653 OR QI-535654
| stats count by WOID
| rename WOID as val
| table val
| map search="search sourcetype=\"QI-535653\" QI-* val=$val$
| stats values(sessionid) by val" maxsearches=10
this question was asked earlier. https://answers.splunk.com/answers/542641/map-command-in-splunk.html for reference.