Splunk Search

What's the difference between nomv and mvcombine?

nabeel652
Builder

Could someone please show the difference between nomv and mvcombine with some examples? What I have seen is that both work exactly the same way and delim parameter in mvcombine doesn't work as expected. Thanks

Labels (3)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Reference : https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Mvcombine

 

The mvcombine command creates a multivalue version of the field you specify, as well as a single value version of the field. The multivalue version is displayed by default.

The single value version of the field is a flat string that is separated by a space or by the delimiter that you specify with the delim argument.

Try below searches one by one to understand the difference

1.

 

| makeresults count=10
| streamstats count

 

 2.

 

| makeresults count=10
| streamstats count
| mvcombine delim="," count

 

3.

 

| makeresults count=10
| streamstats count
| mvcombine delim="," count
| nomv count

 

Happy Splunking!

View solution in original post

Wise_Women
Engager

Great example, thanks!

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Reference : https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Mvcombine

 

The mvcombine command creates a multivalue version of the field you specify, as well as a single value version of the field. The multivalue version is displayed by default.

The single value version of the field is a flat string that is separated by a space or by the delimiter that you specify with the delim argument.

Try below searches one by one to understand the difference

1.

 

| makeresults count=10
| streamstats count

 

 2.

 

| makeresults count=10
| streamstats count
| mvcombine delim="," count

 

3.

 

| makeresults count=10
| streamstats count
| mvcombine delim="," count
| nomv count

 

Happy Splunking!
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...