I have data from a sourcetype that I am searching with a map command like so:
source=outersearch | map search="search source="innersource" | stats avg(Param)"
This search runs correctly and returns the expected number of events from innersource. However, I would like to be able to search for a fieldname with a space in the inner search source. i.e. "Field Name"="String Value". When I isolate the inner search, it works just fine. When I include it in the map string:
source=outersearch | map search="search source="innersource" "Field Name"="String Value" | stats avg(Param)"
The map search returns no results. The documentation says that the map search string is 'literal' but I can't find any documentation on what that means or how it constrains how the search has to be written.
Try this (demonstrates multiple approaches):
source=outersearch | map search="search source=\"innersource\" $Field Name$='String Value' | stats avg(Param)"
Try this (demonstrates multiple approaches):
source=outersearch | map search="search source=\"innersource\" $Field Name$='String Value' | stats avg(Param)"
The escape character ended up working great, i.e.:
\"Field Name with Space\"
It took a little bit of fiddling to figure out which parts of the inner search were causing issues.