topic Split not working according to other commands in Splunk Search

Split not working according to other commands

lshatzer — Mon, 22 Jun 2015 19:43:33 GMT

Here is a log file example:

2015-06-22T09:54:42.767-0600 name=processTwo items="A123"
2015-06-20T21:23:03.279-0600 name=processOne items="OTHER-4, OTHER-3, OTHER-2, OTHER-1, A123"

When I run the following query:

source="test.log" | eval item=split(items, ",") | stats count by item

I get:

item    count
A123    1
OTHER-1 1
OTHER-2 1
OTHER-3 1
A123    1
OTHER-4 1

This is what I expected:

item    count
A123    2
OTHER-1 1
OTHER-2 1
OTHER-3 1
OTHER-4 1

Why is split doing this? I tried mvexpand on item, and that didn't work.

source="test.log" | eval item=split(items, ",") | mvexpand item | search item="A123" | table _time, item, name

This only returns processTwo, and I would expect it to return both processOne and processTwo

I also tried the following:

source="test.log" | makemv items delim="," | stats count by items

Which also does not work.

Re: Split not working according to other commands

stephanefotso — Mon, 22 Jun 2015 23:11:44 GMT

Hello! Try this:

source="test.log" | eval item=split(items, ",") |table item| stats count by item

Thanks

Re: Split not working according to other commands

lshatzer — Mon, 22 Jun 2015 23:23:16 GMT

I forgot to mention I tried that as well, same results.

Re: Split not working according to other commands

stephanefotso — Mon, 22 Jun 2015 23:36:34 GMT

Ok try this:

source="test.log" | eval item=split(items, ",") | mvexpand item|table item| stats count by item

Re: Split not working according to other commands

lshatzer — Mon, 22 Jun 2015 23:44:12 GMT

Same result as well.

Also for fun I swapped the table and mvexpand. Still the same.

Re: Split not working according to other commands

lshatzer — Tue, 23 Jun 2015 00:08:12 GMT

Splunk is trimming the output it displays, which was throwing me off, but is not trimming it for the data it is processing. I needed to either add |eval item=trim(item) or change to |eval item=split(items, ", ") (with a space after the comma).