Splunk Search

ordering of fields in a transaction (mvfind bug?)

brettcave
Builder

I am trying to determine the sequence of pageviews that a visitor visits. I have the following query:

eventtype="AnalyticsLog" | transaction SessionID | makemv uri | eval homeoffset=mvfind(uri, "/") | eval signupoffset=mvfind(uri, "/signup") | eval infooffset=mvfind(uri, "/info") | table SessionID uri homeoffset signupoffset infooffset

When I run the query, the transactions are always sorted alphabetically, so regardless of whether a visitor goes to / -> /signup -> /info or / -> /info -> /signup, the offsets always indicate / = 0, /info = 1 and /signup = 2

How would I go about determining the order of pages viewed by a visitor?

0 Karma
1 Solution

brettcave
Builder

Stumbled across the answer!

transaction docs:

Multivalue rendering options

mvlist=<bool> | <field-list>

Description: Flag controlling whether the multivalued fields of the transaction are (mvlist=t) a list of the original events ordered in arrival order or (mvlist=f) a set of unique field values ordered lexigraphically. If a comma/space delimited list of fields is provided only those fields are rendered as lists. By default, mvlist=f.

View solution in original post

inode
Explorer

Yeah, the magic mvlist does the job, I've provided an example usage here as well:

http://foren6.wordpress.com/2014/11/18/why-is-my-splunk-transaction-not-working/

0 Karma

brettcave
Builder

Stumbled across the answer!

transaction docs:

Multivalue rendering options

mvlist=<bool> | <field-list>

Description: Flag controlling whether the multivalued fields of the transaction are (mvlist=t) a list of the original events ordered in arrival order or (mvlist=f) a set of unique field values ordered lexigraphically. If a comma/space delimited list of fields is provided only those fields are rendered as lists. By default, mvlist=f.

brettcave
Builder

confirmed bug? expected behaviour? incorrect usage?

0 Karma

brettcave
Builder

Here is a sample, retrieved by adding the following to the query:

| search SessionID="6c337bd7-1ee8-4beb-9d5d-5ef30a7721d4".

The transaction shows that /login should be 0, /dashboard = 1 and /profile = 2. This is the event returned by the transaction:

2012-08-03T14:04:32.999Z | INFO | {"sessionId":"6c337bd7-1ee8-4beb-9d5d-5ef30a7721d4","uri":"/login"}
2012-08-03T14:04:36.996Z | INFO | {"sessionId":"6c337bd7-1ee8-4beb-9d5d-5ef30a7721d4","uri":"/dashboard"}
2012-08-03T14:04:37.240Z | INFO | {"sessionId":"6c337bd7-1ee8-4beb-9d5d-5ef30a7721d4","uri":"/profile"}

actual results:

  • mvfind(uri, "/login"): 1
  • mvfind(uri, "/dashboard"): 0
  • mvfind(uri, "/profile"): 2

This is happening in splunkstorm and a local installation of 4.3.1

Is this a bug in the mvfind command?

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...