topic Re: Why does latest does not work with multivalues properly? in Splunk Search

Why does latest does not work with multivalues properly?

MirrorCraze — Wed, 06 Dec 2023 21:15:23 GMT

I have some search before, and after I extract fields (name, status) from json and mvzip it together, I got this table

_time

name

status

nameStatus

2023-12-06 16:06:20

DOWN

A,UP

B,DOWN

C,UP

2023-12-06 16:03:20

A,UP

B,UP

C,UP

2023-12-06 16:00:20

DOWN

A,DOWN

B,UP

C,UP

I want to get only the latest time of the records, so I pipe in the command ...|stats latest(nameStatus). However, the result comes out only as

A,UP

How can I fix this? Thank you!

Re: Why does latest does not work with multivalues properly?

bowesmana — Wed, 06 Dec 2023 21:27:54 GMT

That's interesting and seems as thought it may be a bug, but it may be that it's always worked that way.

The solution is to mvjoin the data so it's single value then split it afterwards, e.g.

... | eval nameStatus=mvjoin(nameStatus,"##") | stats latest(nameStatus) as nameStatus | eval nameStatus=split(nameStatus, "##")

Re: Why does latest does not work with multivalues properly?

MirrorCraze — Wed, 06 Dec 2023 21:38:45 GMT

That's actually a good (and working) idea! Thank you very much! I don't know why latest didn't work either cause technically it should just check with the time and return the whole thing, right?

But yes, it works now, thank you very much!

Re: Why does latest does not work with multivalues properly?

bowesmana — Wed, 06 Dec 2023 21:43:37 GMT

I agree, that you would expect it to return the entire MV field, not just the first value.

I suspect this may be a bug that has existed forever, but one which has a workaround.

If you have a support entitlement with Splunk, you could raise that as a bug and see what they say

This is a simple working example from your data that exhibits the problem

| makeresults format=csv data="_time,name,status,nameStatus 2023-12-06 16:06:20,A:B:C,UP:DOWN:UP,A;UP:B;DOWN:C;UP 2023-12-06 16:03:20,A:B:C,UP:UP:UP,A;UP:B;UP:C;UP 2023-12-06 16:00:20,A:B:C,DOWN:UP:UP,A;DOWN:B;UP:C;UP" | foreach * [ eval <<FIELD>>=split(<<FIELD>>, ":") ] ```| eval nameStatus=mvjoin(nameStatus,"##")``` | stats latest(nameStatus) as nameStatus ```| eval nameStatus=split(nameStatus, "##")```

Re: Why does latest does not work with multivalues properly?

PickleRick — Thu, 07 Dec 2023 08:05:18 GMT

We talked about it with @bowesmana on Slack and it seems the behaviour is intentional and is docummented (albeit a bit vaguely) - "Use the event order functions to return values from fields based on the order in which the event is processed, which is not necessarily chronological or timestamp order. " (from https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Eventorderfunctions )