topic Re: xyseries removes field line break in Getting Data In

xyseries removes field line break

vini98limasilva — Thu, 28 Nov 2019 12:54:13 GMT

Hi, I have the following search where I create two fields which has a line break (Topic and value):

When I do this xyseries will remove the linebreak from field Topic but won't do the same for value. I wanted that both fields keep the line break.

Thanks!

Re: xyseries removes field line break

to4kawa — Fri, 29 Nov 2019 13:06:39 GMT

| makeresults 
| eval _raw="value,Number
2.5,4"
| multikv
| eval value = tostring(value) + ":" + tostring(Number) + " of " + tostring(Number) 
| makemv delim=":" value
| eval Topic="C" + ":" + "Serviceplans" 
| makemv delim=":" Topic
| eval Time="10/2019"
`comment("this is sample data")`
| eval zipped=mvzip(Topic,value)
| mvexpand zipped
| streamstats count
| eval Topic=mvindex(Topic,count -1), value=mvindex(value,count -1)
| table Time Topic value
| xyseries Topic Time value

Hi, @vini98limasilva
How about this?

Re: xyseries removes field line break

woodcock — Tue, 03 Dec 2019 04:44:45 GMT

There are some VERY long-standing subtle bugs related to makemv and similar commands when using delim= where splunk "remembers" things that it should not. This is unequivocally a bug. Here is a search that proves that when you remove the makemv, that it works:

| makeresults 
| eval _raw="value,Number
2.5,4"
| multikv
| eval value = tostring(value) + ":" + tostring(Number) + " of " + tostring(Number) 
| makemv delim=":" value
| eval Topic="C
Serviceplans" 
| eval Time="10/2019"
| xyseries Topic Time value

Re: xyseries removes field line break

vini98limasilva — Tue, 03 Dec 2019 12:16:42 GMT

Hi @to4kawa,

Almost, it separated the values in different rows which wasn't exactly what I needed. Thanks for the answer anyway 🙂

Re: xyseries removes field line break

vini98limasilva — Tue, 03 Dec 2019 12:18:33 GMT

Thanks @woodcock, I just separated the string in different rows! Funny bug though.