Splunk Search

mvexpand gives less results

patilsh
Explorer

Now when i use mvexpand

i just get 600 results in statistics, instead of getting 1412 alll the events as below:
So i am not sure what is causing this problem.

Tags (1)
0 Karma

KailA
Contributor

With the screenshot, we can understand that the problem is maybe from the stats and not the mvexpand.

After the stats, there is 6 events and list_maxsize is by default to 100.
After the mvexpand, 600 events, thats totally normal 🙂

You can change the limits as explain in this answers : https://answers.splunk.com/answers/132521/stats-command-limit-for-values-of-field-xxx-reached-some-v...

KailA

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Converted to answer, because this is the most likely scenario.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @patilsh,

Your ans is limits of mvexpand command. Please go through below links for more details.

Check Limits section of mvexpand.
http://docs.splunk.com/Documentation/Splunk/6.6.1/SearchReference/Mvexpand

Check how to manage it with limits.conf.
http://docs.splunk.com/Documentation/Splunk/6.6.1/Admin/Limitsconf

I hope it will help you.

Thanks
Kamlesh

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

One possible error source is that | mvexpand Levelin will delete any record where Levelin is null.

Try this ...

index=my_search
| stats list(eventData.txLevelIn) as Levelin by callId
| eval Levelin=coalesce(Levelin,"") 
| mvexpand Levelin

dflodstrom
Builder

I'm not sure why this hasn't been accepted as the answer. It does appear that mvexpand negates any results where the value of the target field is null. I read your answer before looking at your query and ended up replacing my ... | eval filed=if(isnull(field), ... with the coalesce you used. Much appreciated.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...