Why does latest does not work with multivalues properly?

[MirrorCraze]

I have some search before, and after I extract fields (name, status) from json and mvzip it together, I got this table

_time	name	status	nameStatus
2023-12-06 16:06:20	A B C	UP DOWN UP	A,UP B,DOWN C,UP
2023-12-06 16:03:20	A B C	UP UP UP	A,UP B,UP C,UP
2023-12-06 16:00:20	A B C	DOWN  UP UP	A,DOWN B,UP C,UP

I want to get only the latest time of the records, so I pipe in the command  ...|stats latest(nameStatus). However, the result comes out only as

A,UP

How can I fix this? Thank you!

[bowesmana · Accepted solution]

That's interesting and seems as thought it may be a bug, but it may be that it's always worked that way.

The solution is to mvjoin the data so it's single value then split it afterwards, e.g.

...
| eval nameStatus=mvjoin(nameStatus,"##")
| stats latest(nameStatus) as nameStatus
| eval nameStatus=split(nameStatus, "##")

[MirrorCraze]

That's actually a good (and working) idea! Thank you very much! I don't know why latest didn't work either cause technically it should just check with the time and return the whole thing, right?

But yes, it works now, thank you very much!

[PickleRick]

We talked about it with @bowesmana on Slack and it seems the behaviour is intentional and is docummented (albeit a bit vaguely) - "Use the event order functions to return values from fields based on the order in which the event is processed, which is not necessarily chronological or timestamp order. " (from https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Eventorderfunctions )

[bowesmana]

I agree, that you would expect it to return the entire MV field, not just the first value.

I suspect this may be a bug that has existed forever, but one which has a workaround.

If you have a support entitlement with Splunk, you could raise that as a bug and see what they say

This is a simple working example from your data that exhibits the problem

| makeresults format=csv data="_time,name,status,nameStatus
2023-12-06 16:06:20,A:B:C,UP:DOWN:UP,A;UP:B;DOWN:C;UP
2023-12-06 16:03:20,A:B:C,UP:UP:UP,A;UP:B;UP:C;UP
2023-12-06 16:00:20,A:B:C,DOWN:UP:UP,A;DOWN:B;UP:C;UP"
| foreach * [ eval <<FIELD>>=split(<<FIELD>>, ":") ]
```| eval nameStatus=mvjoin(nameStatus,"##")```
| stats latest(nameStatus) as nameStatus
```| eval nameStatus=split(nameStatus, "##")```