map

Description

Executes a search query for each incoming event.

Syntax

map <subsearch> [<maxsearches>]

Mandatory Arguments

Parameter	Syntax	Description
<subsearch>	[ subsearch ]	The query must be enclosed in square brackets and start with a source (source, script, makeresults, etc.).

info

Fields whose names are written with dollar signs ($<field>$) will be replaced with corresponding values from the incoming events.

Optional Arguments

Parameter	Syntax	Default	Description
<maxsearches>	maxsearches=<int>	10	The maximum number of search queries.

warning

A maxsearches=0 value does not indicate unlimited search.

Query Examples

In the first example, sub-queries will be executed for the first three events from the math_logs index. The variable res will be assigned the value of host_name from the incoming event.

Example #1

 source math_logs
 | map maxsearches=3
    [source tweets
    | eval res = $host_name$ ]

Example #2

source math_logs
| map
    [source tweets
    | eval res = $host_name$ ]
| where res == "host121"

Example #3

source tweets8 qsize=1
| map
    [source math_logs | eval res = mvcount($index$) ]