Why is transaction not making multivalue fields in event order?

[Jason]

I have a bunch of events bunched into transactions, and I am trying to use the latest (time-wise) value of a field, so I was searching with the following:

 searchquery | transaction foo maxspan=5m maxpause=1m delim="," | eval LastBar=mvindex(bar, -1)

There is only only one bar per event, thus the multivalue field is being created by transaction. The problem is LastBar is not getting set to the last (newest) bar, but to the last (highest) bar lexographically. Events in the transaction display from oldest to newest (strange, considering transactions themselves are listed from new to old, but I can live with that) but the mv order does not seem related to the event order.

Am I misunderstanding how mv fields are created/used, or is this a bug? If not a bug, how do I pull the earliest or latest event's field from a multivalue field?

[Jason · Accepted solution]

There is an option to pass to transaction to make the mv field comply with event order:

searchquery | transaction foo maxspan=5m maxpause=1m delim="," mvlist=bar | eval LastBar=mvindex(bar, -1)

This will create the multivalue bar field in event order. You can also specify mvlist=true to apply event-order to all mv fields created by transaction.

[tonopahtaos]

This is great information.

[Lowell]

Also note that the transaction command will drop duplicate values in a multi-valued field. So using mvlist option, as shown here, will not only preserves order but duplicates values as well. This is very important if you want to total a field, like in this example: eventtype=ftp | transaction host pid mvlist=bytes | eventstats total_bytes=sum(bytes) by host,pid