What's the difference between nomv and mvcombine?

[nabeel652]

Could someone please show the difference between nomv and mvcombine with some examples? What I have seen is that both work exactly the same way and delim parameter in mvcombine doesn't work as expected. Thanks

[Wise_Women]

Great example, thanks!

[renjith_nair · Accepted solution]

Reference : https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Mvcombine

The mvcombine command creates a multivalue version of the field you specify, as well as a single value version of the field. The multivalue version is displayed by default.

The single value version of the field is a flat string that is separated by a space or by the delimiter that you specify with the delim argument.

Try below searches one by one to understand the difference

1.

| makeresults count=10
| streamstats count

 2.

| makeresults count=10
| streamstats count
| mvcombine delim="," count

3.

| makeresults count=10
| streamstats count
| mvcombine delim="," count
| nomv count