I have a bunch of events bunched into transactions, and I am trying to use the latest (time-wise) value of a field, so I was searching with the following:
searchquery | transaction foo maxspan=5m maxpause=1m delim="," | eval LastBar=mvindex(bar, -1)
There is only only one bar per event, thus the multivalue field is being created by transaction. The problem is LastBar is not getting set to the last (newest) bar, but to the last (highest) bar lexographically. Events in the transaction display from oldest to newest (strange, considering transactions themselves are listed from new to old, but I can live with that) but the mv order does not seem related to the event order.
Am I misunderstanding how mv fields are created/used, or is this a bug? If not a bug, how do I pull the earliest or latest event's field from a multivalue field?
There is an option to pass to transaction to make the mv field comply with event order:
searchquery | transaction foo maxspan=5m maxpause=1m delim="," mvlist=bar | eval LastBar=mvindex(bar, -1)
This will create the multivalue bar field in event order. You can also specify mvlist=true to apply event-order to all mv fields created by transaction.
There is an option to pass to transaction to make the mv field comply with event order:
searchquery | transaction foo maxspan=5m maxpause=1m delim="," mvlist=bar | eval LastBar=mvindex(bar, -1)
This will create the multivalue bar field in event order. You can also specify mvlist=true to apply event-order to all mv fields created by transaction.
This is great information.
Also note that the transaction
command will drop duplicate values in a multi-valued field. So using mvlist
option, as shown here, will not only preserves order but duplicates values as well. This is very important if you want to total a field, like in this example: eventtype=ftp | transaction host pid mvlist=bytes | eventstats total_bytes=sum(bytes) by host,pid