Why does the split function fail for list_split_failure_1 and 2 but succeeds for list_split_success?

[rkoster]

| makeresults count=1
| eval list_split_failure_1 = "fail:,searching old data:,searching new"
| eval list_split_failure_2 = "fail:,searching old ata:,searching new"
| eval list_split_success = "fail:,searching old qata:,searching old dta:,searching old ta:,searching new"
| eval list_split_failure_1 = split(list_split_failure_1, ",")
| eval list_split_failure_2 = split(list_split_failure_2, ",")
| eval list_split_success = split(list_split_success, ",")

Can someone help me to understand why the split function fails for list_split_failure_1 and 2 but succeeds for list_split_success?

[johnhuang · Accepted solution]

This issue was discussed a while back and the consensus is that it's a bug introduced on 8.2.x+

https://community.splunk.com/t5/Splunk-Search/Multivalue-field-which-contains-the-string-quot-data-q...