topic Re: What's the difference between chart functions list() and values()? Is there a similar function that doesn't dedup? in Splunk Search

What's the difference between chart functions list() and values()? Is there a similar function that doesn't dedup?

twinspop — Fri, 15 Feb 2013 22:43:48 GMT

Both list() and values() return distinct values of an MV field. Although list() claims to return the values in the order received, real world use isn't proving that out. It is also (apparently) lexicographically sorted, contrary to the docs. Is there a function that will return all values, dups and all, in the order of the log entries?

Example:

index=uexlog sid | transaction SID | stats list(uri) as URIs list(rtt) as RTT by SID

Returns a list of SIDs, each with a list of URIs hit for that session and a list of RTTs. However, because list() dedups, the URIs and RTTs don't match up. And the list of URIs is most definitely in lexicographical order, not the original order of the events as received.

Thanks,
Jon

Re: What's the difference between chart functions list() and values()? Is there a similar function that doesn't dedup?

martin_mueller — Sat, 16 Feb 2013 00:15:50 GMT

list() does not dedup. Consider this query:

| gentimes start=-1 increment=1h | eval foo=0 | stats list(foo) values(foo)

It yields 24 zeroes for list() and 1 zero for values().

However, by default list() is limited to only yield the first 100 values, see http://docs.splunk.com/Documentation/Splunk/latest/admin/limitsconf (list_maxsize).

You can test your local limit with this:

| gentimes start=-1 increment=1s | eval foo = starttime % 10000  | stats list(foo) values(foo)

You'll get 50 displayed each, with list having 50 more values and values having 9950 more values using the default limits.conf settings.

Re: What's the difference between chart functions list() and values()? Is there a similar function that doesn't dedup?

twinspop — Sat, 16 Feb 2013 00:24:08 GMT

Dammit. You're right. The transaction command is the one getting me. Need mvlist=t. Apologies. Thanks for the help.

Re: What's the difference between chart functions list() and values()? Is there a similar function that doesn't dedup?

martin_mueller — Sat, 16 Feb 2013 00:30:10 GMT

Here's one with multivalue string fields:

| gentimes start=-1 increment=1h | eval f1 = starttime % 7200 . "foo" | eval f2 = starttime % 10800 . "foo" | eval f = f1.",".f2 | fields - f1 f2 | makemv f delim="," | stats list(f) values(f)

Does not dedup for me.

Edit: Indeed, transaction can be a bugger.

Re: What's the difference between chart functions list() and values()? Is there a similar function that doesn't dedup?

swarnkar — Tue, 13 Sep 2016 09:50:22 GMT

Is there a way to get list() finctionality with tstats...In my app we are currently using tstats to read from a Accelerated datamodel, but in one of the situation we need to retrieve multivalued field with sequence of the values intact. Which is possible with list(), But tstats doent support list().

Re: What's the difference between chart functions list() and values()? Is there a similar function that doesn't dedup?

martin_mueller — Wed, 14 Sep 2016 01:46:00 GMT

tstats isn't great with ordering... Ideally, you'd open a new question for this to explore the possibilities and alternatives.

Re: What's the difference between chart functions list() and values()? Is there a similar function that doesn't dedup?

swarnkar — Thu, 15 Sep 2016 05:10:35 GMT

Sure I will. Thanks a lot for the response.

Re: What's the difference between chart functions list() and values()? Is there a similar function that doesn't dedup?

fujimori — Thu, 15 Sep 2016 05:44:19 GMT

good answer!