topic Re: Multivalue field which contains the string "data:" cause the UI to display all values as a single line in Splunk Search

Multivalue field which contains the string "data:" cause the UI to display all values as a single line

johnhuang — Mon, 15 Nov 2021 21:17:57 GMT

Took some trial and error to figure out why some multivalue fields were being displayed as a single line.

If the string "data:" appears in any values in multivalue field, for examples using stats values(x) AS x, the multivalue field will display as a single line.

Are there any way to escape this behavior?

UPDATE: Thanks everyone for testing and help identify that this issue does not affect v8.1.2.

It appears to affect v8.2+

Re: Multivalue field which contains the string "data:" cause the UI to display all values as a single line

bhargavi — Sat, 13 Nov 2021 10:53:59 GMT

Hi @johnhuang ,

I have just copied the same query given by you, but the results are multivalue only. Unsure why you got in a single row. Can you try again?

Re: Multivalue field which contains the string "data:" cause the UI to display all values as a single line

yuanliu — Mon, 15 Nov 2021 00:42:18 GMT

This is an incredible find! I can confirm that, in a plain installation, multi-valued field with any value matching the regex "data\s*:" will be displayed in single line, as if there is a compulsory mvzip(). Before I post additional diagnosis, let me demonstrate an idiotic workaround: add the following to the end

| eval desc_data = mvjoin(desc_data, " ")

Note: the newline must be entered as literal (Ctrl + "Enter" in search window), not as "\n", for example. This should get the display as you intended, even though desc_data becomes single-valued after this.

Now to diagnosis. Like yourself, I made lots of tests. Stripped to the bare bones, the "data: spell", or compulsory mvzip syndrome, can be demonstrated with the following:

category	name
fruits	apple,orange,strawberry,apricot,my data : blueberry,mango

Note:

Only one of the values contains the pattern "data\s*:". The space character can be anything, even a newline.
The spell-bound pattern can be prefixed by other patterns; in this demonstration, "my ".
In the above example, field "category" is just an accessary and not a necessary part of the demonstration.

I cannot find anything explicit in etc/system/defaults that can explain this spell even though "data:" appears in several entries in conf.conf. I would consider this a bug as it can really catch many by surprise.

Re: Multivalue field which contains the string "data:" cause the UI to display all values as a single line

PickleRick — Sun, 14 Nov 2021 22:33:25 GMT

I can confirm. Simple

| makeresults count=10
| streamstats count
| eval count="data: ".count
| stats values(count)

Produces results in a single line, separated by commas.

Splink 8.2.2.1

Re: Multivalue field which contains the string "data:" cause the UI to display all values as a single line

bowesmana — Mon, 15 Nov 2021 20:59:58 GMT

Splunk 8.0.1 standalone installation does not behave as you describe, it displays desc_data as MV on multiple lines, same as desc field.

Re: Multivalue field which contains the string "data:" cause the UI to display all values as a single line

bowesmana — Mon, 15 Nov 2021 21:14:26 GMT

I have tried this on Splunk 7.3.9, 8.0.1 and two instances of 8.2.1 and it exhibits the behaviour on 8.2.1, but not on the other two versions.

In Splunk 8.2.1 even though it displays the data on a single line, the data is still MV, i.e. mvindex and mvfind functions still work as though it is an MV field, i.e.

| eval c=mvcount(name) | eval f=mvindex(name,2) | eval i=mvfind(name, "my data : blueberry")

return 6, 'strawberry" and 4 respectively.

Re: Multivalue field which contains the string "data:" cause the UI to display all values as a single line

johnhuang — Mon, 15 Nov 2021 21:16:00 GMT

Very creative of you Yuanliu.

I took your solution and split it back into a multivalue field which worked!

| eval desc_data=split(mvjoin(desc_data, ";"), ";") | eval mv_count_desc_data=MVCOUNT(desc_data)

Re: Multivalue field which contains the string "data:" cause the UI to display all values as a single line

johnhuang — Mon, 15 Nov 2021 21:20:56 GMT

bowesmana,

Great work there. I did not think this was a new bug. I just tested this on 8.1.2 confirm it was not affected.

This bug seem to have been introduced 8.2.1

Re: Multivalue field which contains the string "data:" cause the UI to display all values as a single line

johnhuang — Mon, 15 Nov 2021 21:21:24 GMT

Looks like a 8.2.x + bug.

Re: Multivalue field which contains the string "data:" cause the UI to display all values as a single line

yuanliu — Tue, 16 Nov 2021 02:36:19 GMT

| eval desc_data=split(mvjoin(desc_data, ";"), ";") | eval mv_count_desc_data=MVCOUNT(desc_data)

Unfortunately, join then split doesn't help me with display. Tested in 8.2.0 and 8.2.2. Gives me the same display as if no change is made

Re: Multivalue field which contains the string "data:" cause the UI to display all values as a single line

johnhuang — Tue, 16 Nov 2021 04:17:53 GMT

You're right, my bad -- I inadvertently tested this on 8.1.x.

Some other interesting observations:

You can insert newlines at the end of each values and the UI will respect it (Wrap Results needs to be turned on).

| rex field=desc_data mode=sed "s/$/\n/g"

You can't, however, try to interact with the comma. It seems like the comma only exists in the UI. For example replacing comma with newline doesn't work.

| rex field=desc_data mode=sed "s/\,/\n/g"

Trying another character like "!" works:

| rex field=desc_data mode=sed "s/\!/\\0\n/g"