I'm writing up a custom event renderer to show the differences in two events in a transaction. Naturally, transaction will put in multivalued fields if the values are different between the two events.
I have seen both
<% count = event.fields['_count'] %>
<% tags = event.fields.get('_tags','') %>
formations in the search app's discovered.html. Can either of these be used to get values from a multivalued field, or get the count of values in a multivalued field? Or do I have to load up my search with a ton of evals?
Yes, multivalue fields are accessible via the Python SDK. Let's use the following working example.
Get a search job that has multivalue fields (I coerce that by using
my_job = splunk.search.dispatch('| windbag | makemv delim=" " sample | fields sample, host, source')
and then grab the first result to play around with:
result = my_job.results
result is actually an object that contains all of the multivalue data as well as tags:
>>> result.fields.keys() ['sample', 'host', 'source', '_cd', '_raw', '_time'] >>> result.fields['sample'] Je,peux,manger,du,verre,,Ã§a,ne,me,fait,pas,de,mal. >>> result.fields['sample'] <splunk.search.ResultFieldValue object at 0xa7dd8d0> >>> result.fields['sample'].value 'Je' >>> result.fields['sample'].tags  >>> len(result.fields['sample']) 12 >>> result.fields['sample'].value 'mal.'
From the example above, you'll note that:
So, in answer to my immediate question, <% makovar = event.fields['mvfield'] %> was able to access my second multivalued field value, and <% fieldcount = len(event.fields['mvfield']) %> got me how many values there were. I never knew this was python - thanks!