I am banging my head trying to understand the map
command and how it works. I have one search that returns values:
index=offers sourcetype=offer producttype=* earliest=-5m latest=now
| stats count by producttype
| table producttype
This gives me the a set of data. So far so good.
|producttype|
1
3
9
12
What I thought map
did was to pass these $productID$ values to the 'mapped query and run it up to maxsearches time (in this case 4). So my next line was :
map maxsearches=4 search = "index=offers sourcetype=offer producttype=$producttype$ earliest=-5m latest=now
| timechart ...some stuff...
| blah blah
| etc.... "
I get no results found. (This is a simplified version of my search and the foreach is not going to be an option with my final goal). What am I failing to understand? Thank you in advance!
You are missing the search
operator just inside of the double-quotes; like this:
index=offers sourcetype=offer producttype=* earliest=-5m latest=now
| stats count by producttype
| map maxsearches=4 search="search index=offers sourcetype=offer producttype=$producttype$ earliest=-5m latest=now
| timechart ...some stuff...
| blah blah
| etc.... "
@aberkow makes a good point. map
is powerful, but costly and there often are other ways to accomplish the task. Try a subsearch.
In this example, the query within brackets (the subsearch) fetches your product types. Change the argument to head
to return the desired number of producttype values. The results of the subsearch become part of the main search, like index=offers sourcetype=offers (producttype=1 OR producttype=3 OR producttype=9 OR producttype=12)) earliest=-5m ...
.
index=offers sourcetype=offer [index=offers sourcetype=offer producttype=* earliest=-5m latest=now
| stats count by producttype | head 4
| fields producttype | format ] earliest=-5m latest=now
| timechart ...some stuff...
| blah blah
| etc....
The subsearch
way seems to work but it is not documented as supported for a very good reason that is fairly complicated; You should stick to using double-quotes
. See my answer.
What are you trying to accomplish with the map
command? I've rarely run into a case where I need it over different commands