Split not working according to other commands

[lshatzer]

Here is a log file example:

2015-06-22T09:54:42.767-0600 name=processTwo items="A123"
2015-06-20T21:23:03.279-0600 name=processOne items="OTHER-4, OTHER-3, OTHER-2, OTHER-1, A123"

When I run the following query:

source="test.log" | eval item=split(items, ",") | stats count by item

I get:

item    count
A123    1
OTHER-1 1
OTHER-2 1
OTHER-3 1
A123    1
OTHER-4 1

This is what I expected:

item    count
A123    2
OTHER-1 1
OTHER-2 1
OTHER-3 1
OTHER-4 1

Why is split doing this? I tried mvexpand on item, and that didn't work.

source="test.log" | eval item=split(items, ",") | mvexpand item | search item="A123" | table _time, item, name

This only returns processTwo, and I would expect it to return both processOne and processTwo

I also tried the following:

source="test.log" | makemv items delim="," | stats count by items

Which also does not work.

[lshatzer · Accepted solution]

Splunk is trimming the output it displays, which was throwing me off, but is not trimming it for the data it is processing. I needed to either add |eval item=trim(item) or change to |eval item=split(items, ", ") (with a space after the comma).

[stephanefotso]

Hello! Try this:

source="test.log" | eval item=split(items, ",") |table item| stats count by item

Thanks

[lshatzer]

I forgot to mention I tried that as well, same results.

[stephanefotso]

Ok try this:

source="test.log" | eval item=split(items, ",") | mvexpand item|table item| stats count by item 

[lshatzer]

Same result as well.

Also for fun I swapped the table and mvexpand. Still the same.