On understanding array versus multivalue fields

[cdieringerwm]

Greetings. My Splunk instance parses messages which has a JSON array type:

```

{ tags: ["info", "foo", "bar"] }

```

Let's say I want to search for events where precisely the second index of the tags field has the value "foo".

1. Having consulted the Splunk docs, I found Array and object expressions . I tried using Array and object expressions, and all of my queries ended poorly
2. Eventually I was pointed to MultivalueEvalFunctions , which worked.

Using Multivalue fns  left me with many questions:

1. Why is my JSON array parsed as a multivalue? Why is it not an array?
2. If I execute `typeof('tags')`, I get "Invalid". Why? Shouldn't it be Array or Multivalue?
3. If I execute `typeof('tags{}')`, I get "Multivalue". Why? What did that operator do, and why was it required?

More or less, as a polyglot programmer with a decade of experience, I found splunk operations on collections to be not just unintuitive, but counter intuitive.  Beyond my explicit three question categories above, if compelled, let me know other best-known-practices around searching with array-ish fields 🙂

[PickleRick]

The SCS docs describe SPL2, not the SPL which is used in Splunk Enterprise and Splunk Cloud. In SPL there are no arrays. There are only multivalued fields.

The {} in 'tags{}' is just a part of the name. It's not an operator.