Splunk Search

Delim argument in stats function no longer supported?

cycheng
Path Finder

In http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Stats, I found that there is an optional argument "delim". I tried below searches:

index=my_index | stats values(my_key)

and

index=my_index | stats delim="," values(my_key)

both return a list that split by "\n". Is this delim argument no longer supported?

Tags (1)

rturk
Builder

Hi Cycheng - Good question. What is it you're trying to do exactly, because the use of delim in the context of stats isn't immediately clear.

From the documentation:

delim
Syntax: delim=<string>
Description: Used to specify how the values in the list() or values() aggregation are delimited. (default is a single space.)

I can't seem to figure out a search that demonstrates it's function.

These searches give the same results:

index=_internal | stats values(group) AS groups
index=_internal | stats delim="_" values(group) AS groups

alt text

While the following, when used with the mvcombine command, I think it does what you're looking for (truncated):

index=_internal | stats delim="_" values(group) AS groups | mvcombine groups

alt text

So I think the delim command only does anything useful when further processing is performed on the command (in this case by mvcombine)

index=_internal | stats delim=", " values(group) AS groups | mvcombine groups

alt text

I hope this helps, and if anyone else wants to chime in, I'm all ears!

Disclaimer: I may be going about this the wrong way, as I'm essentially using the "poke it with a stick and see what it does" approach...

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...