I have an issue with a field within the map command not being evaluated appropriately. The scenario is this:
do something...
| table puser phost earliest latest
| map search="search index=winevents src_ip=$phost$ earliest=$earliest$ latest=$latest$ | eval puser=$puser$ | eval phost=$phost$ | head 1" maxsearches=100
| table puser phost
The issue is that 'phost' will display results only when the phost is an ip address. If the 'phost' value is a host name it will not display. Any idea why? NOTE: when I display the puser, phost via the first table command i get host name values. Only when map command runs do the host names not display in the second table command.
You should probably change src_ip=$phost$
to either src=$phost$
or host=$phost$
or similar. It seems exceedingly unlikely that a field called src_ip
would contain anything other than an IP address.
You are either running in Fast Mode
instead of Smart Mode
OR you may be running into this problem, depending on how your field is created:
https://www.splunk.com/blog/2011/10/07/cannot-search-based-on-an-extracted-field.html
Ok. i will take a look at the document. I have been running in smart mode. I have one more question if you don't mind sir. After the map command runs I table puser and phost. After that I need to perform a lookup of the puser to get the full name of the puser. And, then table puser, full name, phost. How can I carry the phost field into final table after the lookup?
do something...
| table puser phost earliest latest
| map search="search index=winevents src_ip=$phost$ earliest=$earliest$ latest=$latest$ | eval puser=$puser$ | eval phost=$phost$ | head 1" maxsearches=100
| table puser phost
| lookup user_info account_name AS user OUTPUT ....
You should probably change src_ip=$phost$
to either src=$phost$
or host=$phost$
or similar. It seems exceedingly unlikely that a field called src_ip
would contain anything other than an IP address.
sorry that was a typo on my part. the field in the index is src. good catch. however, the problem still remains that phost is not displaying host names just IP. The work around is to table src, not phost.
thank you