Saved search that uses the map command is missing events randomly

Applicability

Description

Facing an issue with 2 similar saved searches.

In both cases, the saved searches, retrieve events from a certain index and send their content as parameters in a macro executed within the map command.

The macro retrieves events from the indexes specified does some processing, and collects the results in another index.

The problem is that not all the events are processed in the macro.
 Inspecting the search log, only some events are retrieving to the macro, missing others.


 

Investigation

 SPL for the 2 saved searches:

etc/apps/dashboard_mon/local/savedsearches.conf
 

[anomaly_outliers_full]
search = index=anomaly_conf
| table kpi_name, kpi_source, model, day_from_hh, day_to_hh, night_from_hh, night_to_hh, model_choice, day_n_outliers, group, service, severity
| rex mode=sed field=model "s/\"//g"
| rex mode=sed field=model "s/'/\"/g"
| map search="|`anomalyDetection_outlier_full($kpi_name$, $kpi_source$, $model$, $day_from_hh$, $day_to_hh$, $night_from_hh$, $night_to_hh$, $model_choice$, 
$group$, $service$, $severity$)`"

anomaly_alarms_fulletc/apps/dashboard_mon/local/savedsearches.conf
[anomaly_alarms_full]
search = index=anomaly_conf
| table kpi_name, model_choice, night_from_hh, night_to_hh, night_n_outliers, day_from_hh, day_to_hh, day_n_outliers, group, service, severity
| eval earlx=day_n_outliers*300+900
| eval earl_day="-"+$earlx$+"s"
| eval early=night_n_outliers*300+900
| eval earl_night="-"+$early$+"s"
| eval earl_night=if(night_n_outliers="-",earl_day,earl_night)
| map search="|`anomalyDetection_alarms_full2($kpi_name$, $earl_day$, $earl_night$, $model_choice$, $night_from_hh$, $night_to_hh$, $night_n_outliers$, $day_from_hh$,
 $day_to_hh$, $day_n_outliers$, $group$, $service$, $severity$)`"

No maxsearches was defined.

Resolution

It was found that the cause of the issue was the 'map' command (from the SPL query) that had a limit in maxsearches.
The default setting is 10.  Once the maxsearches setting was increased, all of the expected events appeared.
 

map (<searchoption> | <savedsplunkoption>) [maxsearches=int]

For example:

| map search="search starttimeu::$start$ endtimeu::$end$" maxsearches=20

SearchReference Map