Splunk Search

On understanding array versus multivalue fields

cdieringerwm
Observer

Greetings. My Splunk instance parses messages which has a JSON array type:

 

```

{ tags: ["info", "foo", "bar"] }

```

Let's say I want to search for events where precisely the second index of the tags field has the value "foo".

 

  1. Having consulted the Splunk docs, I found Array and object expressions . I tried using Array and object expressions, and all of my queries ended poorly
  2. Eventually I was pointed to MultivalueEvalFunctions , which worked.

Using Multivalue fns  left me with many questions:

  1. Why is my JSON array parsed as a multivalue? Why is it not an array?
  2. If I execute `typeof('tags')`, I get "Invalid". Why? Shouldn't it be Array or Multivalue?
  3. If I execute `typeof('tags{}')`, I get "Multivalue". Why? What did that operator do, and why was it required?

More or less, as a polyglot programmer with a decade of experience, I found splunk operations on collections to be not just unintuitive, but counter intuitive.  Beyond my explicit three question categories above, if compelled, let me know other best-known-practices around searching with array-ish fields 🙂

0 Karma

PickleRick
SplunkTrust
SplunkTrust

The SCS docs describe SPL2, not the SPL which is used in Splunk Enterprise and Splunk Cloud. In SPL there are no arrays. There are only multivalued fields.

The {} in 'tags{}' is just a part of the name. It's not an operator.

0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...