Splunk Search

mvmap command after migrate from 9.0.5 to 9.3.1

pavellr
Loves-to-Learn

Mvmap has different results on different versions

left screen is 9.3.1 version right is 9.0.5 

pavellr_0-1729708967654.png

if field will have more then one value result will be equal

pavellr_1-1729709103176.png

 

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I can confirm that this is fixed in 9.4.0

 

| makeresults format=csv data="field
a
a:b"
| eval field = split(field, ":"), count = mvcount(field), map = mvmap(field, "1")

 

In 9.4.0, it returns

countfieldmap
1a1
2
a
b
1
1

Before the fix, it would return the following, incorrect first row.

countfieldmap
1aa
2
a
b
1
1
0 Karma

pavellr
Loves-to-Learn

Is there any chance this will be fixed?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Maybe you can report to Splunk support?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

This looks like a new bug in 9.3

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...