Splunk Search

Why does having multiple values for mvlist produce unexpected results for my transaction search?

gt_dev
Explorer

I am still not able to get 2 fields in the mvlist list. Here is my transaction line now:

| transaction visitID mvlist=actionName

I get a nice set of values that groups actions by visitID. However, if I change the above line to:

| transaction visitID mvlist=actionName,event_time

I get a totally different result set that doesn't look anything like the way I want it. Below is my full search:

source="/var/log/logstash/dynatraceqa*" businessTransaction="Real User Page Actions - Copy"
| transaction visitID mvlist=actionName
| table  application, visitID,  event_time, actionName, eventcount
| sort event_time
| addtotals row=f col=t fieldname=Total labelfield=actionName eventcount
| rename event_time as "Start Time", application as "Application", visitID as "Visit ID", actionName as "User Action". eventcount as  "Action Count" 
0 Karma

gt_dev
Explorer

...continued:

If i use mvlist=true i get the following:
alt text

0 Karma

gt_dev
Explorer

When i use the following in my transaction line:
| transaction visitID mvlist=actionName
I get the following results:
alt text

When i use the following in my transaction line:
| transaction visitID mvlist=actionName, apdex_score

I get the following results:
alt text

0 Karma

sundareshr
Legend

What kind of results are you expecting? Try this, without transaction command

source="/var/log/logstash/dynatraceqa*" businessTransaction="Real User Page Actions - Copy" | stats list(actionName) as actions by visitID application _time | eval eventcount=mvcount(actions) | rename ... | table ...
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...