Splunk Search

Delim argument in stats function no longer supported?

cycheng
Path Finder

In http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Stats, I found that there is an optional argument "delim". I tried below searches:

index=my_index | stats values(my_key)

and

index=my_index | stats delim="," values(my_key)

both return a list that split by "\n". Is this delim argument no longer supported?

Tags (1)

rturk
Builder

Hi Cycheng - Good question. What is it you're trying to do exactly, because the use of delim in the context of stats isn't immediately clear.

From the documentation:

delim
Syntax: delim=<string>
Description: Used to specify how the values in the list() or values() aggregation are delimited. (default is a single space.)

I can't seem to figure out a search that demonstrates it's function.

These searches give the same results:

index=_internal | stats values(group) AS groups
index=_internal | stats delim="_" values(group) AS groups

alt text

While the following, when used with the mvcombine command, I think it does what you're looking for (truncated):

index=_internal | stats delim="_" values(group) AS groups | mvcombine groups

alt text

So I think the delim command only does anything useful when further processing is performed on the command (in this case by mvcombine)

index=_internal | stats delim=", " values(group) AS groups | mvcombine groups

alt text

I hope this helps, and if anyone else wants to chime in, I'm all ears!

Disclaimer: I may be going about this the wrong way, as I'm essentially using the "poke it with a stick and see what it does" approach...

Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...