For the following search command, what is the expected output? | makeresults
| eval text_string = "I:red_heart:Splunk"
| eval text_split = split(text_string, "") I would expect a text_split ...
See more...
For the following search command, what is the expected output? | makeresults
| eval text_string = "I:red_heart:Splunk"
| eval text_split = split(text_string, "") I would expect a text_split field that either contains an array like this: text_split == [ 'I', ' ', 'S', 'p', 'l', 'u', 'n', 'k' ] or if split by byte, potentially dependent on the locale: text_split == [ 'I', 'â', '', '¤', 'ï', '¸', '¿', 'S', 'p', 'l', 'u', 'n', 'k' ] But not the current output, were the data : text_split == [ 'I', '�', '�', '�', '�', '�', '�', 'S', 'p', 'l', 'u', 'n', 'k' ] The use of characters that aren't fixed width also screws up search entry highlighting and text selection, but that isn't related to the split function. | eval text_string = "I:red_heart:Splunk" `comment("Try highlighting a word in this comment in the SPL Editor")` It looks like mvjoin() reverses the split(), but mvcombine fails. (edit attempt failed to add the red heart back to the code samples; replaced with :red_heart:)