Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

passing previous result fields to localize and map

$
0
0

Say I have a search like this, trying to find all the events that occurred on hosts around the some_text event:


index=_internal host=host1 OR host=host2 source=splunkd.log some_text | localize | map search="search index=_internal"
How do I tell localize and map to only search over the hosts that matched in the original search? I tried adding host=$host$ to the map search, as the documentation indicates, but I get the error that it did not find value for required attribute host. Will the syntax change if I use it in a dashboard?


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>