Dashboards & Visualizations

Issue with mvindex in dashboard eval when using negative index value


We are using Splunk 7.2.7.

When I use a negative index value in mvindex in a search eval, it works fine.

However, when I use a negative index value in a dashboard eval, it fails.

Here is a dashboard to demonstrate the issue.

alt text

Click on the "populate_tokens" cell in each row to populate the tokens that will display on the right-hand panel.

  <label>mvindex Demo</label>
          <query>| makeresults
| eval ipv6_addr="[1:2:3:4:5:6:7:8]:80"
| append [| makeresults | eval ipv6_addr="[1:2:3:4:5:6:7:8]:443"]
| eval ipv6_port_mvindex_neg1 = mvindex(split(ipv6_addr,":"),-1)
| eval ipv6_port_mvindex_pos8 = mvindex(split(ipv6_addr,":"),8)
| eval populate_tokens = ""
| fields - _time
| fields ipv6_addr, ipv6_port_mvindex_pos8, ipv6_port_mvindex_neg1, populate_tokens</query>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
          <condition field="ipv6_addr"></condition>
          <condition field="ipv6_port_mvindex_pos8"></condition>
          <condition field="ipv6_port_mvindex_neg1"></condition>
          <condition field="populate_tokens">
            <eval token="ipv6_addr">$row.ipv6_addr$</eval>
            <eval token="row_ipv6_port_mvindex_neg1">$row.ipv6_port_mvindex_neg1$</eval>
            <eval token="row_ipv6_port_mvindex_pos8">$row.ipv6_port_mvindex_pos8$</eval>
            <eval token="mvindex_ipv6_port_mvindex_neg1">mvindex(split($row.ipv6_addr$,":"),-1)</eval>
            <eval token="mvindex_ipv6_port_mvindex_pos8">mvindex(split($row.ipv6_addr$,":"),8)</eval>
          <h1>Token output</h1>
          <table style="width:100%">
              <th>Token name</th>
              <th>Token value</th>
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...