Splunk Search

Why does "eventstats last()" fail for one column when I add mvlist=t after the transaction command?

szabados
Communicator

In my search, I'm using a transaction. After that, I create a table from the results, then I want to apply an eventstats last() function.
In my table, I have two columns, let's say colA, and colB.
If I'm running the transaction without any further arguments, the last() function works for both columns, like this:

| transaction keyfield
| table colA, colB, keyfield
| eventstats last(colA) as last_colA, last(colB) as last_colB by keyfield

However, for another reason, I need to run the transaction with mvlist=t.
When I do this, the eventstats function fails, but only for one column.
In this case, fails for colA, but works fine with colB.

I don't get what is the difference, since I'm having the same type of values in both columns.
If it works for one column, why does it fail for the other one?

0 Karma

snoobzilla
Builder

I am guessing that the issue here is something to do with multivalue fields.

A couple of options come to mind, do eventstats first...

| eventstats last(colA) as last_colA, last(colB) as last_colB by keyfield
| transaction keyfield
| table colA, colB, last_colA, last_colB, keyfield

That said transaction and eventstats is REALLY REALLY inefficient. I would suggest eliminating transaction command altogether because it can be a monster resource hog and yield incomplete results when used for high volume searches. Eventstats is pretty brutal too.

Alternatives...

| stats list(colA) AS colA last(colA) as last_colA list(colB) AS colB last(colB) as last_colB by keyfield

OR

| stats list(colA) AS colA list(colB) AS colB by keyfield
| eval last_colA=mvindex(colA,-1)
| eval last_colB=mvindex(colB,-1)

Let me know if this works and relative performance.

0 Karma

snoobzilla
Builder

Did you sort this out?

0 Karma

somesoni2
Revered Legend

Do you get single value for last_colA and last_colB columns OR multivalued fields?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...