topic Re: Possible bug when using mvzip with xpath extracted fields in Splunk Search

Can anyone confirm possible bug when using mvzip with xpath extracted fields?

siddharthprabhu — Tue, 13 Jun 2023 10:12:32 GMT

Hello Splunk experts,

I am encountering strange behaviour when using mvzip on fields extracted using xpath commands.

I have provided a toy dataset below that mimics my XML events. I expect mvzip to combine the values in nickname and title pairwise. However, the search below creates only one pair and that too with the "wrong" set of values; the second value from nickname is combined with the first value from title. The other pair is not combined at all.

| makeresults | eval _raw="<foo><bar nickname=\"spock\" title=\"commander\"></bar></foo><foo><bar nickname=\"scotty\" title=\"engineer\"></bar></foo>" | xpath outfield=nickname "//foo/bar/@nickname" field=_raw | xpath outfield=title "//foo/bar/@title" field=_raw | eval zipped=mvzip(nickname, title, "|")

When I use the same syntax on fields extracted via regular expressions, the output is correct. So, I'm suspecting that mvzip doesn't play nice with multivalue fields extracted using xpath.

Can anyone confirm if this is a bug or if I'm doing something wrong? I am running Splunk 8.1.3 in case anyone knows if this has been addressed in a later release.

Re: Possible bug when using mvzip with xpath extracted fields

ITWhisperer — Sun, 11 Jun 2023 17:50:27 GMT

Looks like a bug with xpath (also present in 9.0.4) - xpath appears to join all mv fields in the events.

Try using spath (different syntax for path)

| makeresults | eval _raw="<foo><bar nickname=\"spock\" title=\"commander\"></bar></foo><foo><bar nickname=\"scotty\" title=\"engineer\"></bar></foo>" | spath output=nickname "foo.bar{@nickname}" | spath output=title "foo.bar{@title}" | eval zipped=mvzip(nickname, title, "|")

Re: Possible bug when using mvzip with xpath extracted fields

siddharthprabhu — Sun, 11 Jun 2023 18:31:57 GMT

Thank you! I have tried using spath before and it indeed does the job for simple extractions. However, I was trying to get the xpath approach to work because my real data is deeply nested with repeating node elements and I require complex xPath expressions to extract the fields of interest.

Oh well, at least I know I wasn't going crazy! Hopefully Splunk will fix this in a coming release.

Re: Possible bug when using mvzip with xpath extracted fields

PickleRick — Sun, 11 Jun 2023 19:22:17 GMT

It's not even that.

If you do

| eval tc=mvcount(title)
| eval nc=mvcount(nickname)

instead of the last eval, you'll see that for unknown reason only the nicknames are joined.

Some more digging into this shows that only the "title" attribute seems to _not_ get joined. Regardless of number of the attributes or their order.

Re: Possible bug when using mvzip with xpath extracted fields

burwell — Mon, 12 Jun 2023 04:18:00 GMT

Hi. It would be great to file a ticket with Splunk Support to make sure they are aware of the bug.

Re: Possible bug when using mvzip with xpath extracted fields

siddharthprabhu — Mon, 12 Jun 2023 09:19:17 GMT

Sure, I'd be happy to. Could you please guide me on how to do that?

Re: Possible bug when using mvzip with xpath extracted fields

burwell — Mon, 12 Jun 2023 14:52:32 GMT

Hi @siddharthprabhu

Whoever in your organization has access to create Splunk Support tickets can follow this https://community.splunk.com/t5/Random/How-do-i-file-a-Splunk-Support-Case-contact-Splunk-Support/td-p/148639

Thanks.