In trying to use makemv, which seems incredibly simple, I've been ingesting multiple iterations of a single event with multiple values per the single key to get a working example of my own. I've had to regress down to what I thought would be the simplest possible data sample, but with still no success.
My data is:
direction=up, down, left, right
That's it. I can call that event up with it's manually-labeled sourcetype (sample009), and it appears correctly. However, makemv does nothing to it.
my search:
sourcetype=sample009 | makemv delim=", " direction | stats count(direction)
yields a one-row table, where I'd have expected a four-row table.
Next,
sourcetype=sample009 | makemv delim=", " direction
yields 1 value for direction (up). I would have expected 4 values.
I don't think it's possible to make a much simpler set of data to experiment with, so am I fundamentally misunderstanding something, or is this a bug? Maybe I have some funky precedence issue?
