Splunk Search

Understanding map command

mtrochym
Observer

I am banging my head trying to understand the map command and how it works. I have one search that returns values:

index=offers sourcetype=offer producttype=* earliest=-5m latest=now
| stats count by producttype
| table producttype

This gives me the a set of data. So far so good.
|producttype|
1

3
9
12

What I thought map did was to pass these $productID$ values to the 'mapped query and run it up to maxsearches time (in this case 4). So my next line was :

map maxsearches=4 search = "index=offers sourcetype=offer producttype=$producttype$ earliest=-5m latest=now
| timechart ...some stuff...
| blah blah
| etc.... "

I get no results found. (This is a simplified version of my search and the foreach is not going to be an option with my final goal). What am I failing to understand? Thank you in advance!

Tags (1)
0 Karma

woodcock
Esteemed Legend

You are missing the search operator just inside of the double-quotes; like this:

index=offers sourcetype=offer producttype=* earliest=-5m latest=now
| stats count by producttype
| map maxsearches=4 search="search index=offers sourcetype=offer producttype=$producttype$ earliest=-5m latest=now
| timechart ...some stuff...
| blah blah
| etc.... "
0 Karma

richgalloway
SplunkTrust
SplunkTrust

@aberkow makes a good point. map is powerful, but costly and there often are other ways to accomplish the task. Try a subsearch.
In this example, the query within brackets (the subsearch) fetches your product types. Change the argument to head to return the desired number of producttype values. The results of the subsearch become part of the main search, like index=offers sourcetype=offers (producttype=1 OR producttype=3 OR producttype=9 OR producttype=12)) earliest=-5m ....

index=offers sourcetype=offer [index=offers sourcetype=offer producttype=* earliest=-5m latest=now
| stats count by producttype | head 4
| fields producttype | format ] earliest=-5m latest=now
| timechart ...some stuff...
| blah blah
| etc.... 
---
If this reply helps you, Karma would be appreciated.
0 Karma

woodcock
Esteemed Legend

The subsearch way seems to work but it is not documented as supported for a very good reason that is fairly complicated; You should stick to using double-quotes. See my answer.

0 Karma

aberkow
Builder

What are you trying to accomplish with the map command? I've rarely run into a case where I need it over different commands

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...