Mvmap has different results on different versions
left screen is 9.3.1 version right is 9.0.5
if field will have more then one value result will be equal
I can confirm that this is fixed in 9.4.0
| makeresults format=csv data="field
a
a:b"
| eval field = split(field, ":"), count = mvcount(field), map = mvmap(field, "1")
In 9.4.0, it returns
count | field | map |
1 | a | 1 |
2 | a b | 1 1 |
Before the fix, it would return the following, incorrect first row.
count | field | map |
1 | a | a |
2 | a b | 1 1 |
Is there any chance this will be fixed?
Maybe you can report to Splunk support?
This looks like a new bug in 9.3