Splunk® Enterprise

Search Reference

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF



The map command is a looping operator that runs a search repeatedly for each input event or result. You can run the map command on a saved search or an ad hoc search.


map (<searchoption> | <savedsplunkoption>) [maxsearches=int]

Required arguments

Syntax: <string>
Description: Name of a saved search to run for each input result.
Default: No default.
Syntax: [subsearch] | search="<string>"
Description: An ad hoc search to run for each input result. For example:
...| map search="search index=_internal earliest=$myearliest$ latest=$mylatest$".
Default: No default.

Optional arguments

Syntax: maxsearches=<int>
Description: The maximum number of searches to run. A message is generated if there are more search results than the maximum number that you specify.
Default: 10


Known limitations

You cannot use the append or appendpipe commands with the map command.

Variable for field names

When using a saved search or a literal search, the map command supports the substitution of $variable$ strings that match field names in the input results. A search with a string like $count$, for example, will replace the variable with the value of the count field in the input search result.

When using the map command in a dashboard <form>, use double dollar signs ($$) to specify a variable string. For example, $$count$$. See Dashboards and forms.

Search ID field

The map command also supports a search ID field, provided as $_serial_id$. The search ID field will have a number that increases incrementally each time that the search is run. In other words, the first run search will have the ID value 1, and the second 2, and so on.

Basic examples

1. Invoke the map command with a saved search

error | localize | map mytimebased_savedsearch

2. Map the start and end time values

... | map search="search starttimeu::$start$ endtimeu::$end$" maxsearches=10

Extended examples

1. Use a Sudo event to locate the user logins

This example illustrates how to find a Sudo event and then use the map command to trace back to the computer and the time that users logged on before the Sudo event. Start with the following search for the Sudo event.

sourcetype=syslog sudo | stats count by user host

This search returns a table of results.

User Host Count
userA serverA 1
userB serverA 3
userA serverB 2

Pipe these results into the map command, substituting the username.

sourcetype=syslog sudo | stats count by user host | map search="search index=ad_summary username=$user$ type_logon=ad_last_logon"

It takes each of the three results from the previous search and searches in the ad_summary index for the logon event for the user. The results are returned as a table.

_time computername computertime username usertime
10/12/16 8:31:35.00 AM Workstation$ 10/12/2016 08:25:42 userA 10/12/2016 08:31:35 AM

(Thanks to Splunk user Alacercogitatus for this example.)

See also

gentimes, search


Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the map command.


This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 6.3.11, 6.3.12


The searches launched by map don't know anything about the outer search. In order to copy over data from the row of the outer search responsible for launching a map search
So we need to do -- > "your_search with fields populated "| map eval field_name=$field_name
(thanks to martin_muller from splunk answers)

Cyber castle
January 17, 2019

You list the function and default values of "maxsearches" but not the upper limit. I assume that this is related to the "subsearch" limit, but this should all be explained with specifics.

February 4, 2017

The map syntax in this documentation is incorrect:
1. the [... | map search="....." maxsearches=n] syntax does not work for stats commands of a certain complexity. More specifically:

- "... | stats count" works
- BUT "... | stats count(eval(x="..."))" does not work

2. What works with both commands is the following syntax:

- "... | map [....search....] maxsearches=n"

so replace quotes with square brackets and ignore the "search=".

August 4, 2016

What is the max value for maxsearches? Is there a way to NOT have a max (set to 0 or -1)?

August 18, 2015

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters