Splunk Search

How do I make fields with a replacement for an argument work inside a saved search with the map command?

triest
Communicator

I'm sure there's a really easy answer, but it isn't coming to me so I'd greatly appreciate some help.

If I define a saved search test as:

| makeresults | eval foo="cat", bar="dog", baz="moose" | fields $fields$

Then it works as expected with savedsearch (returns fields foo and bar or bar and baz), but fails with the map command (it returns one field foo bar or bar baz)

Saved Search Examples:

| savedsearch fields="foo bar"

Returns the fields foo and bar

| savedsearch fields="bar baz"

Returns the fields bar and baz

Map

| makeresults
| eval fields="foo bar"
| map test

Returns the field foo bar (which is empty) instead of the fields foo and bar

| makeresults
| eval fields="foo baz"
| map test

Similarly returns field foo baz instead of the fields foo and baz

Not surprisingly, if I specify one field it does work:

| makeresults
| eval fields="foo"
| map test

I'm sure this is something really simple, but the solution just isn't coming to me.

Tags (2)
0 Karma
1 Solution

triest
Communicator

Of course as soon as I post I find the answer on answers: Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table t...

The short version is you define a macro (I did qe for quote eater):

[qe(1)]
args = a
definition = $a$
iseval = 0

Then you use that in your savedsearch:

| makeresults | eval foo="cat", bar="dog", baz="moose" | fields `qe($fields$)`

Even with that modification, it still works with the savedsearch command.

I would love it if some one found a solution that didn't require modifying the saved search (imagine the saved search is from an app; modifying it makes updating fun as you have to check if they've modified it etc)

View solution in original post

0 Karma

triest
Communicator

Of course as soon as I post I find the answer on answers: Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table t...

The short version is you define a macro (I did qe for quote eater):

[qe(1)]
args = a
definition = $a$
iseval = 0

Then you use that in your savedsearch:

| makeresults | eval foo="cat", bar="dog", baz="moose" | fields `qe($fields$)`

Even with that modification, it still works with the savedsearch command.

I would love it if some one found a solution that didn't require modifying the saved search (imagine the saved search is from an app; modifying it makes updating fun as you have to check if they've modified it etc)

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...