- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
On understanding array versus multivalue fields
Greetings. My Splunk instance parses messages which has a JSON array type:
```
{ tags: ["info", "foo", "bar"] }
```
Let's say I want to search for events where precisely the second index of the tags field has the value "foo".
- Having consulted the Splunk docs, I found Array and object expressions . I tried using Array and object expressions, and all of my queries ended poorly
- Eventually I was pointed to MultivalueEvalFunctions , which worked.
Using Multivalue fns left me with many questions:
- Why is my JSON array parsed as a multivalue? Why is it not an array?
- If I execute `typeof('tags')`, I get "Invalid". Why? Shouldn't it be Array or Multivalue?
- If I execute `typeof('tags{}')`, I get "Multivalue". Why? What did that operator do, and why was it required?
More or less, as a polyglot programmer with a decade of experience, I found splunk operations on collections to be not just unintuitive, but counter intuitive. Beyond my explicit three question categories above, if compelled, let me know other best-known-practices around searching with array-ish fields 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The SCS docs describe SPL2, not the SPL which is used in Splunk Enterprise and Splunk Cloud. In SPL there are no arrays. There are only multivalued fields.
The {} in 'tags{}' is just a part of the name. It's not an operator.
