Splunk Search

Delim argument in stats function no longer supported?

cycheng
Path Finder

In http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Stats, I found that there is an optional argument "delim". I tried below searches:

index=my_index | stats values(my_key)

and

index=my_index | stats delim="," values(my_key)

both return a list that split by "\n". Is this delim argument no longer supported?

Tags (1)

rturk
Builder

Hi Cycheng - Good question. What is it you're trying to do exactly, because the use of delim in the context of stats isn't immediately clear.

From the documentation:

delim
Syntax: delim=<string>
Description: Used to specify how the values in the list() or values() aggregation are delimited. (default is a single space.)

I can't seem to figure out a search that demonstrates it's function.

These searches give the same results:

index=_internal | stats values(group) AS groups
index=_internal | stats delim="_" values(group) AS groups

alt text

While the following, when used with the mvcombine command, I think it does what you're looking for (truncated):

index=_internal | stats delim="_" values(group) AS groups | mvcombine groups

alt text

So I think the delim command only does anything useful when further processing is performed on the command (in this case by mvcombine)

index=_internal | stats delim=", " values(group) AS groups | mvcombine groups

alt text

I hope this helps, and if anyone else wants to chime in, I'm all ears!

Disclaimer: I may be going about this the wrong way, as I'm essentially using the "poke it with a stick and see what it does" approach...

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...