Hi, I have the following search where I create two fields which has a line break (Topic and value):
index="example" sourcetype="trial"
| stats avg(availability) as value, dc(name) as Number
| eval value = tostring(value) + ":" + tostring(Number) + " of " + tostring(Number) | makemv delim=":" value
| eval Topic="C" + ":" + "Serviceplans" | makemv delim=":" Topic
| eval Time="10/2019"
| xyseries Topic Time value
When I do this xyseries will remove the linebreak from field Topic but won't do the same for value. I wanted that both fields keep the line break.
Thanks!
There are some VERY long-standing subtle bugs related to makemv
and similar commands when using delim=
where splunk "remembers" things that it should not. This is unequivocally a bug. Here is a search that proves that when you remove the makemv
, that it works:
| makeresults
| eval _raw="value,Number
2.5,4"
| multikv
| eval value = tostring(value) + ":" + tostring(Number) + " of " + tostring(Number)
| makemv delim=":" value
| eval Topic="C
Serviceplans"
| eval Time="10/2019"
| xyseries Topic Time value
There are some VERY long-standing subtle bugs related to makemv
and similar commands when using delim=
where splunk "remembers" things that it should not. This is unequivocally a bug. Here is a search that proves that when you remove the makemv
, that it works:
| makeresults
| eval _raw="value,Number
2.5,4"
| multikv
| eval value = tostring(value) + ":" + tostring(Number) + " of " + tostring(Number)
| makemv delim=":" value
| eval Topic="C
Serviceplans"
| eval Time="10/2019"
| xyseries Topic Time value
Thanks @woodcock, I just separated the string in different rows! Funny bug though.
| makeresults
| eval _raw="value,Number
2.5,4"
| multikv
| eval value = tostring(value) + ":" + tostring(Number) + " of " + tostring(Number)
| makemv delim=":" value
| eval Topic="C" + ":" + "Serviceplans"
| makemv delim=":" Topic
| eval Time="10/2019"
`comment("this is sample data")`
| eval zipped=mvzip(Topic,value)
| mvexpand zipped
| streamstats count
| eval Topic=mvindex(Topic,count -1), value=mvindex(value,count -1)
| table Time Topic value
| xyseries Topic Time value
Hi, @vini98limasilva
How about this?
Hi @to4kawa,
Almost, it separated the values in different rows which wasn't exactly what I needed. Thanks for the answer anyway 🙂