Splunk Search

mvcombine removes timestamp

Hazel
Communicator

Hello,

I am doing a query, where I get a multi valued field and I need to append something to each value depending what the value is. I can't find a way to apply a statement to the multiple values, the only thing I can think to do is to expand the field make my change and recombine it. However, when I recombine it, the timestamp _time loses its content and this is a field we need.

The command is:

host=glon19u10329 index="DTS" sourcetype="config" | xpath "//value/with/cfg/serverUrl" outfield=emsName | mvexpand emsName | eval status = if(match(emsName,"tcp://ems-dit*"),"Tier 2", if(match(emsName,"tcp://vsol43a-7801*"), "Tier 2", if(match(emsName, "tcp://vsgl43a-2016*"), "Tier 2", if(match(emsName,"tcp://vhbl31a04103*"), "Tier 2", "Tier 3")))) | strcat emsName ":" status emsName | mvcombine emsName

Before applying the mvcombine, the time stamp shows correctly.

Example

BEFORE:
_time     emsName
19/08/2010 09:00     tcp://ems-dit-eu-uat-1: Tier 2
19/08/2010 09:00     tcp://emsuatdata: Tier 3
....

AFTER (as one event)
_time     emsName
          tcp://ems-dit-eu-uat-1: Tier 2
          tcp://emsuatdata: Tier 3

Any idea why the _time field doesn't make it through the mvcombine?

Thanks Hazel

Tags (3)

Lowell
Super Champion

That's weird. Have you tried renaming _time before your mvepand and then rename it back after mvcombine?

For example:

host=glon19u10329 index="DTS" sourcetype="config" | xpath "//value/with/cfg/serverUrl" outfield=emsName | rename _time as keep_time | mvexpand emsName | eval status = if(match(emsName,"tcp://ems-dit*"),"Tier 2", if(match(emsName,"tcp://vsol43a-7801*"), "Tier 2", if(match(emsName, "tcp://vsgl43a-2016*"), "Tier 2", if(match(emsName,"tcp://vhbl31a04103*"), "Tier 2", "Tier 3")))) | strcat emsName ":" status emsName | mvcombine emsName | rename keep_time as _time

Not sure if this will work or not. I know that sometimes _* fields get handled differently so perhaps this trick will get past that.

steveyz
Splunk Employee
Splunk Employee

Yes, it is intended behavior. As a rule, we don't use any _* fields in mvcombine. This is because you may often see events that differ only in internal fields that are not shown (i.e. _cd), and then wonder why they weren't combined.

Hazel
Communicator

thanks this works as a workaround. Would be interested to know if this is the intended behaviour for the _time field though!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...