Splunk Search

Delim argument in stats function no longer supported?

cycheng
Path Finder

In http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Stats, I found that there is an optional argument "delim". I tried below searches:

index=my_index | stats values(my_key)

and

index=my_index | stats delim="," values(my_key)

both return a list that split by "\n". Is this delim argument no longer supported?

Tags (1)

rturk
Builder

Hi Cycheng - Good question. What is it you're trying to do exactly, because the use of delim in the context of stats isn't immediately clear.

From the documentation:

delim
Syntax: delim=<string>
Description: Used to specify how the values in the list() or values() aggregation are delimited. (default is a single space.)

I can't seem to figure out a search that demonstrates it's function.

These searches give the same results:

index=_internal | stats values(group) AS groups
index=_internal | stats delim="_" values(group) AS groups

alt text

While the following, when used with the mvcombine command, I think it does what you're looking for (truncated):

index=_internal | stats delim="_" values(group) AS groups | mvcombine groups

alt text

So I think the delim command only does anything useful when further processing is performed on the command (in this case by mvcombine)

index=_internal | stats delim=", " values(group) AS groups | mvcombine groups

alt text

I hope this helps, and if anyone else wants to chime in, I'm all ears!

Disclaimer: I may be going about this the wrong way, as I'm essentially using the "poke it with a stick and see what it does" approach...

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...