Splunk Search

Why does the split function fail for list_split_failure_1 and 2 but succeeds for list_split_success?

rkoster
Explorer
| makeresults count=1
| eval list_split_failure_1 = "fail:,searching old data:,searching new"
| eval list_split_failure_2 = "fail:,searching old ata:,searching new"
| eval list_split_success = "fail:,searching old qata:,searching old dta:,searching old ta:,searching new"
| eval list_split_failure_1 = split(list_split_failure_1, ",")
| eval list_split_failure_2 = split(list_split_failure_2, ",")
| eval list_split_success = split(list_split_success, ",")


Can someone help me to understand why the split function fails for list_split_failure_1 and 2 but succeeds for list_split_success?

Labels (1)
0 Karma
1 Solution

johnhuang
Motivator

This issue was discussed a while back and the consensus is that it's a bug introduced on 8.2.x+

https://community.splunk.com/t5/Splunk-Search/Multivalue-field-which-contains-the-string-quot-data-q...

 

View solution in original post

johnhuang
Motivator

This issue was discussed a while back and the consensus is that it's a bug introduced on 8.2.x+

https://community.splunk.com/t5/Splunk-Search/Multivalue-field-which-contains-the-string-quot-data-q...

 

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...