I'm writing up a custom event renderer to show the differences in two events in a transaction. Naturally, transaction will put in multivalued fields if the values are different between the two events.
I have seen both
<% count = event.fields['_count'] %>
and
<% tags = event.fields.get('_tags','') %>
formations in the search app's discovered.html. Can either of these be used to get values from a multivalued field, or get the count of values in a multivalued field? Or do I have to load up my search with a ton of evals?
Yes, multivalue fields are accessible via the Python SDK. Let's use the following working example.
Get a search job that has multivalue fields (I coerce that by using makemv
😞
my_job = splunk.search.dispatch('| windbag | makemv delim=" " sample | fields sample, host, source')
and then grab the first result to play around with:
result = my_job.results[0]
result
is actually an object that contains all of the multivalue data as well as tags:
>>> result.fields.keys()
['sample', 'host', 'source', '_cd', '_raw', '_time']
>>> result.fields['sample']
Je,peux,manger,du,verre,,ça,ne,me,fait,pas,de,mal.
>>> result.fields['sample'][0]
<splunk.search.ResultFieldValue object at 0xa7dd8d0>
>>> result.fields['sample'][0].value
'Je'
>>> result.fields['sample'][0].tags
[]
>>> len(result.fields['sample'])
12
>>> result.fields['sample'][11].value
'mal.'
From the example above, you'll note that:
Yes, multivalue fields are accessible via the Python SDK. Let's use the following working example.
Get a search job that has multivalue fields (I coerce that by using makemv
😞
my_job = splunk.search.dispatch('| windbag | makemv delim=" " sample | fields sample, host, source')
and then grab the first result to play around with:
result = my_job.results[0]
result
is actually an object that contains all of the multivalue data as well as tags:
>>> result.fields.keys()
['sample', 'host', 'source', '_cd', '_raw', '_time']
>>> result.fields['sample']
Je,peux,manger,du,verre,,ça,ne,me,fait,pas,de,mal.
>>> result.fields['sample'][0]
<splunk.search.ResultFieldValue object at 0xa7dd8d0>
>>> result.fields['sample'][0].value
'Je'
>>> result.fields['sample'][0].tags
[]
>>> len(result.fields['sample'])
12
>>> result.fields['sample'][11].value
'mal.'
From the example above, you'll note that:
So, in answer to my immediate question, <% makovar = event.fields['mvfield'][1] %> was able to access my second multivalued field value, and <% fieldcount = len(event.fields['mvfield']) %> got me how many values there were. I never knew this was python - thanks!