Splunk Search

What's the difference between nomv and mvcombine?

nabeel652
Builder

Could someone please show the difference between nomv and mvcombine with some examples? What I have seen is that both work exactly the same way and delim parameter in mvcombine doesn't work as expected. Thanks

Labels (3)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Reference : https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Mvcombine

 

The mvcombine command creates a multivalue version of the field you specify, as well as a single value version of the field. The multivalue version is displayed by default.

The single value version of the field is a flat string that is separated by a space or by the delimiter that you specify with the delim argument.

Try below searches one by one to understand the difference

1.

 

| makeresults count=10
| streamstats count

 

 2.

 

| makeresults count=10
| streamstats count
| mvcombine delim="," count

 

3.

 

| makeresults count=10
| streamstats count
| mvcombine delim="," count
| nomv count

 

Happy Splunking!

View solution in original post

Wise_Women
Engager

Great example, thanks!

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Reference : https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Mvcombine

 

The mvcombine command creates a multivalue version of the field you specify, as well as a single value version of the field. The multivalue version is displayed by default.

The single value version of the field is a flat string that is separated by a space or by the delimiter that you specify with the delim argument.

Try below searches one by one to understand the difference

1.

 

| makeresults count=10
| streamstats count

 

 2.

 

| makeresults count=10
| streamstats count
| mvcombine delim="," count

 

3.

 

| makeresults count=10
| streamstats count
| mvcombine delim="," count
| nomv count

 

Happy Splunking!
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...