Here is a log file example:
2015-06-22T09:54:42.767-0600 name=processTwo items="A123"
2015-06-20T21:23:03.279-0600 name=processOne items="OTHER-4, OTHER-3, OTHER-2, OTHER-1, A123"
When I run the following query:
source="test.log" | eval item=split(items, ",") | stats count by item
I get:
item count
A123 1
OTHER-1 1
OTHER-2 1
OTHER-3 1
A123 1
OTHER-4 1
This is what I expected:
item count
A123 2
OTHER-1 1
OTHER-2 1
OTHER-3 1
OTHER-4 1
Why is split
doing this? I tried mvexpand
on item
, and that didn't work.
source="test.log" | eval item=split(items, ",") | mvexpand item | search item="A123" | table _time, item, name
This only returns processTwo
, and I would expect it to return both processOne
and processTwo
I also tried the following:
source="test.log" | makemv items delim="," | stats count by items
Which also does not work.
Splunk is trimming the output it displays, which was throwing me off, but is not trimming it for the data it is processing. I needed to either add |eval item=trim(item)
or change to |eval item=split(items, ", ")
(with a space after the comma).
Splunk is trimming the output it displays, which was throwing me off, but is not trimming it for the data it is processing. I needed to either add |eval item=trim(item)
or change to |eval item=split(items, ", ")
(with a space after the comma).
Hello! Try this:
source="test.log" | eval item=split(items, ",") |table item| stats count by item
Thanks
I forgot to mention I tried that as well, same results.
Ok try this:
source="test.log" | eval item=split(items, ",") | mvexpand item|table item| stats count by item
Same result as well.
Also for fun I swapped the table
and mvexpand
. Still the same.