Splunk Search

mvlist functionality

javiles1960
Explorer

My search (1)

transaction PG SessionID mvlist=SessionEventNet nullstr=0|eventstats sum(SessionEventNet) as SessionNet

works great, my search (2)

transaction PG SessionID mvlist=PN nullstr=0|eventstats sum(PN) as CashIn

works great as well, my search (3)

transaction PG SessionID mvlist=SessionEventNet PN nullstr=0|eventstats sum(SessionEventNet) as SessionNet sum(PN) as CashIn

does not produce the desired results on CashIn, only on SessionEventNet
Anyone???

Tags (2)

AlekseiVasiliev
Explorer

You should use quotes:

mvlist="SessionEventNet PN"

javiles1960
Explorer

Here is how I solved it:

transaction PG SessionID mvlist=(t SessionEventNet PN) nullstr=0|eventstats sum(SessionEventNet) as SessionNet sum(PN) as CashIn

javiles1960
Explorer

already tried it. The default delim=" ", can be changed to delim="," however I think I tried both ways.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The doc says mvlist takes a comma-separated list of fields, so try this:

transaction PG SessionID mvlist=SessionEventNet,PN nullstr=0|eventstats sum(SessionEventNet) as SessionNet sum(PN) as CashIn

http://docs.splunk.com/Documentation/Splunk/6.0.2/SearchReference/Transaction

0 Karma

kenkenou
Explorer

Did you try mvlist=(actionName,event_time*)* ?

Add () to the fileds.May be it works.

0 Karma

gt_dev
Explorer

I am still not able to get 2 fields in the mvlist list. Here is my transaction line now:

| transaction visitID mvlist=actionName

i get a nice set of values that groups actions by visitID. However, if i change the above line to:

| transaction visitID mvlist=actionName,event_time

I get a totally different result set that doesn't look anything like the way i want it. Below is my full query:

source="/var/log/logstash/dynatraceqa*" businessTransaction="Real User Page Actions - Copy"
| transaction visitID mvlist=actionName
| table  application, visitID,  event_time, actionName, eventcount
| sort event_time
| addtotals row=f col=t fieldname=Total labelfield=actionName eventcount
| rename event_time as "Start Time", application as "Application", visitID as "Visit ID", actionName as "User Action". eventcount as "Action Count" 
0 Karma

ppablo
Retired

Hi @gt_dev

This question is over 2 years old. I'd suggest asking your own question instead of trying to get help on an old thread.

0 Karma

gt_dev
Explorer

good idea

0 Karma

javiles1960
Explorer

already tried it. The default delim=" ", can be changed to delim="," however I think I tried both ways.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...