Splunk Search

mvmap command after migrate from 9.0.5 to 9.3.1

pavellr
Loves-to-Learn

Mvmap has different results on different versions

left screen is 9.3.1 version right is 9.0.5 

pavellr_0-1729708967654.png

if field will have more then one value result will be equal

pavellr_1-1729709103176.png

 

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I can confirm that this is fixed in 9.4.0

 

| makeresults format=csv data="field
a
a:b"
| eval field = split(field, ":"), count = mvcount(field), map = mvmap(field, "1")

 

In 9.4.0, it returns

countfieldmap
1a1
2
a
b
1
1

Before the fix, it would return the following, incorrect first row.

countfieldmap
1aa
2
a
b
1
1
0 Karma

pavellr
Loves-to-Learn

Is there any chance this will be fixed?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Maybe you can report to Splunk support?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

This looks like a new bug in 9.3

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...