topic Re: mvlist functionality in Splunk Search

mvlist functionality

javiles1960 — Thu, 27 Mar 2014 21:29:36 GMT

My search (1)

transaction PG SessionID mvlist=SessionEventNet nullstr=0|eventstats sum(SessionEventNet) as SessionNet

works great, my search (2)

transaction PG SessionID mvlist=PN nullstr=0|eventstats sum(PN) as CashIn

works great as well, my search (3)

transaction PG SessionID mvlist=SessionEventNet PN nullstr=0|eventstats sum(SessionEventNet) as SessionNet sum(PN) as CashIn

does not produce the desired results on CashIn, only on SessionEventNet
Anyone???

Re: mvlist functionality

martin_mueller — Thu, 27 Mar 2014 22:11:36 GMT

The doc says mvlist takes a comma-separated list of fields, so try this:

transaction PG SessionID mvlist=SessionEventNet,PN nullstr=0|eventstats sum(SessionEventNet) as SessionNet sum(PN) as CashIn

http://docs.splunk.com/Documentation/Splunk/6.0.2/SearchReference/Transaction

Re: mvlist functionality

javiles1960 — Thu, 27 Mar 2014 22:31:55 GMT

already tried it. The default delim=" ", can be changed to delim="," however I think I tried both ways.

Re: mvlist functionality

javiles1960 — Thu, 27 Mar 2014 22:32:16 GMT

already tried it. The default delim=" ", can be changed to delim="," however I think I tried both ways.

Re: mvlist functionality

javiles1960 — Fri, 28 Mar 2014 21:21:53 GMT

Here is how I solved it:

transaction PG SessionID mvlist=(t SessionEventNet PN) nullstr=0|eventstats sum(SessionEventNet) as SessionNet sum(PN) as CashIn

Re: mvlist functionality

gt_dev — Tue, 13 Dec 2016 21:25:38 GMT

I am still not able to get 2 fields in the mvlist list. Here is my transaction line now:

| transaction visitID mvlist=actionName

i get a nice set of values that groups actions by visitID. However, if i change the above line to:

| transaction visitID mvlist=actionName,event_time

I get a totally different result set that doesn't look anything like the way i want it. Below is my full query:

source="/var/log/logstash/dynatraceqa*" businessTransaction="Real User Page Actions - Copy"
| transaction visitID mvlist=actionName
| table  application, visitID,  event_time, actionName, eventcount
| sort event_time
| addtotals row=f col=t fieldname=Total labelfield=actionName eventcount
| rename event_time as "Start Time", application as "Application", visitID as "Visit ID", actionName as "User Action". eventcount as "Action Count"

Re: mvlist functionality

ppablo — Tue, 13 Dec 2016 21:30:16 GMT

Hi @gt_dev

This question is over 2 years old. I'd suggest asking your own question instead of trying to get help on an old thread.

Re: mvlist functionality

kenkenou — Tue, 29 Sep 2020 12:07:09 GMT

Did you try mvlist=(actionName,event_time*)* ?

Add () to the fileds.May be it works.

Re: mvlist functionality

gt_dev — Wed, 14 Dec 2016 12:40:38 GMT

good idea

Re: mvlist functionality

AlekseiVasiliev — Tue, 15 Jan 2019 13:50:28 GMT

You should use quotes:

mvlist="SessionEventNet PN"