topic Re: mvexpand gives less results in Splunk Search

mvexpand gives less results

patilsh — Tue, 20 Jun 2017 00:09:00 GMT

Now when i use mvexpand

i just get 600 results in statistics, instead of getting 1412 alll the events as below:
So i am not sure what is causing this problem.

Re: mvexpand gives less results

DalJeanis — Tue, 20 Jun 2017 02:45:50 GMT

One possible error source is that | mvexpand Levelin will delete any record where Levelin is null.

Try this ...

index=my_search
| stats list(eventData.txLevelIn) as Levelin by callId
| eval Levelin=coalesce(Levelin,"") 
| mvexpand Levelin

Re: mvexpand gives less results

kamlesh_vaghela — Tue, 20 Jun 2017 05:14:57 GMT

Hi @patilsh,

Your ans is limits of mvexpand command. Please go through below links for more details.

Check Limits section of mvexpand.
http://docs.splunk.com/Documentation/Splunk/6.6.1/SearchReference/Mvexpand

Check how to manage it with limits.conf.
http://docs.splunk.com/Documentation/Splunk/6.6.1/Admin/Limitsconf

I hope it will help you.

Thanks
Kamlesh

Re: mvexpand gives less results

dflodstrom — Thu, 26 Jul 2018 14:38:53 GMT

I'm not sure why this hasn't been accepted as the answer. It does appear that mvexpand negates any results where the value of the target field is null. I read your answer before looking at your query and ended up replacing my ... | eval filed=if(isnull(field), ... with the coalesce you used. Much appreciated.

Re: mvexpand gives less results

KailA — Thu, 26 Jul 2018 18:13:09 GMT

With the screenshot, we can understand that the problem is maybe from the stats and not the mvexpand.

After the stats, there is 6 events and list_maxsize is by default to 100.
After the mvexpand, 600 events, thats totally normal 🙂

You can change the limits as explain in this answers : https://answers.splunk.com/answers/132521/stats-command-limit-for-values-of-field-xxx-reached-some-values-may-have-been-truncated-or-ignored.html

KailA

Re: mvexpand gives less results

DalJeanis — Sun, 26 Aug 2018 20:33:17 GMT

Converted to answer, because this is the most likely scenario.