Splunk Search

difference between nomv and mvcombine

nabeel652
Builder

Could someone please show the difference between nomv and mvcombine with some examples? What I have seen is that both work exactly the same way and delim parameter in mvcombine doesn't work as expected. Thanks

Labels (3)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Reference : https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Mvcombine

 

The mvcombine command creates a multivalue version of the field you specify, as well as a single value version of the field. The multivalue version is displayed by default.

The single value version of the field is a flat string that is separated by a space or by the delimiter that you specify with the delim argument.

Try below searches one by one to understand the difference

1.

 

| makeresults count=10
| streamstats count

 

 2.

 

| makeresults count=10
| streamstats count
| mvcombine delim="," count

 

3.

 

| makeresults count=10
| streamstats count
| mvcombine delim="," count
| nomv count

 

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Reference : https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Mvcombine

 

The mvcombine command creates a multivalue version of the field you specify, as well as a single value version of the field. The multivalue version is displayed by default.

The single value version of the field is a flat string that is separated by a space or by the delimiter that you specify with the delim argument.

Try below searches one by one to understand the difference

1.

 

| makeresults count=10
| streamstats count

 

 2.

 

| makeresults count=10
| streamstats count
| mvcombine delim="," count

 

3.

 

| makeresults count=10
| streamstats count
| mvcombine delim="," count
| nomv count

 

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...