does mvzip zips wrong values? If yes, why?

[marcokrueger]

Hi,
I have a problem to understand mvzip. For example the query
sourcetype="at-json-traces" "aGAfJ22UVSK_" | spath | rename cookieTraces.traces{}.name as cookieType, cookieTraces.traces{}.value as cookieValue | eval cookies=mvzip(cookieType, cookieValue)
returns an event with three cookie-fields:

• cookies=JSESSIONID,aGAfJ22UVSK_
  
• cookies=uid,01vz0d0000hfqmnzx2
• cookies=uid,aGAfJ22UVSK_

I expected only the first two. Why there is the third cookie also zipped?

Have anybody an idea?
Thanx Marco

P.S. Here ist the trace
{

"startTime": 1366452716541,

"sessionTrace": { "id": "aGAfJ22UVSK_", "isNew": false, "creationTime": 1366452716150 },

"headerTrace": { "map": { "Accept-Language": [ "de-DE" ], "Cookie": [ "JSESSIONID\u003daGAfJ22UVSK_; uid\u003d01vz0d0000hfqmnzx2" ], "Accept-Charset": [ "ISO-8859-1,utf-8;q\u003d0.7,*;q\u003d0.7" ] }},

"cookieTraces": { "traces": [ { "name": "JSESSIONID", "value": "aGAfJ22UVSK_", "age": -1, "version": 0, "secure": false }, { "name": "uid", "value": "01vz0d0000hfqmnzx2", "age": -1, "version": 0, "secure": false } ] },

"traceMap": { "RESPONSE": { "status": 200, "contentType": "text/html; charset\u003dUTF-8", "location": "", "encoding": "UTF-8", "locale": "de_DE", "cookieTraces": { "traces": [ { "name": "uid", "value": "01vz0d0000hfqmnzx2", "age": 31104000, "version": 0, "secure": false, "path": "/" } ] } } }

}

[marcokrueger · Accepted solution]

It is solved now. The reason was I used spath|rename .... instead spath path=xxx output=yyyy | spath path=ZZZ output=AAAA

It gives me a long chain of spath-commands, can I do this a little-bit shorter perhaps?

[marcokrueger]

if I expand it after this with ... | mvexpand cookies it gives 4 events, with two of them are duplicated.
Now there are only the right cookie-cases given (JSESSIONID,aGAfJ22UVSK_ and uid,01vz0d0000hfqmnzx2), but why they are duplicated?