On understanding array versus multivalue fields

cdieringerwm — Thu, 26 Jan 2023 21:54:33 GMT

Greetings. My Splunk instance parses messages which has a JSON array type:

```

{ tags: ["info", "foo", "bar"] }

```

Let's say I want to search for events where precisely the second index of the tags field has the value "foo".

Having consulted the Splunk docs, I found Array and object expressions . I tried using Array and object expressions, and all of my queries ended poorly
Eventually I was pointed to MultivalueEvalFunctions , which worked.

Using Multivalue fns left me with many questions:

Why is my JSON array parsed as a multivalue? Why is it not an array?
If I execute `typeof('tags')`, I get "Invalid". Why? Shouldn't it be Array or Multivalue?
If I execute `typeof('tags{}')`, I get "Multivalue". Why? What did that operator do, and why was it required?

More or less, as a polyglot programmer with a decade of experience, I found splunk operations on collections to be not just unintuitive, but counter intuitive. Beyond my explicit three question categories above, if compelled, let me know other best-known-practices around searching with array-ish fields 🙂

Re: On understanding array versus multivalue fields

PickleRick — Thu, 26 Jan 2023 23:12:10 GMT

The SCS docs describe SPL2, not the SPL which is used in Splunk Enterprise and Splunk Cloud. In SPL there are no arrays. There are only multivalued fields.

The {} in 'tags{}' is just a part of the name. It's not an operator.

topic On understanding array versus multivalue fields in Splunk Search

On understanding array versus multivalue fields

Re: On understanding array versus multivalue fields