Splunk Search

Why does latest does not work with multivalues properly?

MirrorCraze
Explorer

I have some search before, and after I extract fields (name, status) from json and mvzip it together, I got this table

 

_timenamestatusnameStatus
2023-12-06 16:06:20

A

B

C

UP

DOWN

UP

A,UP

B,DOWN

C,UP

2023-12-06 16:03:20

A

B

C

UP

UP

UP

A,UP

B,UP

C,UP

2023-12-06 16:00:20

A

B

C

DOWN 

UP

UP

A,DOWN

B,UP

C,UP

 

I want to get only the latest time of the records, so I pipe in the command  ...|stats latest(nameStatus). However, the result comes out only as

A,UP

 

How can I fix this? Thank you!

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

That's interesting and seems as thought it may be a bug, but it may be that it's always worked that way.

The solution is to mvjoin the data so it's single value then split it afterwards, e.g.

...
| eval nameStatus=mvjoin(nameStatus,"##")
| stats latest(nameStatus) as nameStatus
| eval nameStatus=split(nameStatus, "##")

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

That's interesting and seems as thought it may be a bug, but it may be that it's always worked that way.

The solution is to mvjoin the data so it's single value then split it afterwards, e.g.

...
| eval nameStatus=mvjoin(nameStatus,"##")
| stats latest(nameStatus) as nameStatus
| eval nameStatus=split(nameStatus, "##")

MirrorCraze
Explorer

That's actually a good (and working) idea! Thank you very much! I don't know why latest didn't work either cause technically it should just check with the time and return the whole thing, right?

But yes, it works now, thank you very much!

 

Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

We talked about it with @bowesmana on Slack and it seems the behaviour is intentional and is docummented (albeit a bit vaguely) - "Use the event order functions to return values from fields based on the order in which the event is processed, which is not necessarily chronological or timestamp order. " (from https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Eventorderfunctions )

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I agree, that you would expect it to return the entire MV field, not just the first value.

I suspect this may be a bug that has existed forever, but one which has a workaround.

If you have a support entitlement with Splunk, you could raise that as a bug and see what they say

This is a simple working example from your data that exhibits the problem

| makeresults format=csv data="_time,name,status,nameStatus
2023-12-06 16:06:20,A:B:C,UP:DOWN:UP,A;UP:B;DOWN:C;UP
2023-12-06 16:03:20,A:B:C,UP:UP:UP,A;UP:B;UP:C;UP
2023-12-06 16:00:20,A:B:C,DOWN:UP:UP,A;DOWN:B;UP:C;UP"
| foreach * [ eval <<FIELD>>=split(<<FIELD>>, ":") ]
```| eval nameStatus=mvjoin(nameStatus,"##")```
| stats latest(nameStatus) as nameStatus
```| eval nameStatus=split(nameStatus, "##")```
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...