List
The following topic contains the functions that you can use on lists or to return lists.
mvdedup(X)
This function takes a list X and returns a list with its duplicate values removed.
- Function Input
- collection<T>
- Function Output
- collection<T> with duplicates removed
1. SPL2 example
Returns ["foo","bar","biz","baz"]
in new field dedup_list
.
... | eval dedup_list=mvdedup(["foo", "bar", "foo", "bar", "biz", "baz"]);
2. SPL2 example
Removes duplicates in a field containing a list.
... | eval n=mvdedup(mvfield);
iterator(X,Y)
For documentation on the iterator function, see Iterator.
length(input)
Returns the character length of the provided input. The input can be a map, collection, bytes, or a string.
- Function Input
- type<any>
- Function Output
- integer
SPL2 example
Returns 4.
...| eval n=length([1, 5, 3, 4]);
mvappend(X,...)
Takes an arbitrary list of arguments, where each argument is a single string or a list of strings, and returns all elements as a single flattened list.
- Function Input
- collection<any>
- Function Output
- string
SPL2 example
Returns [\"lorem\",\"lorem\",\"ipsum\",\"dolor\",\"sit\",\"amet\",\"consectetuer\"]
in a new field called newlist
.
... | eval newlist = mvappend("lorem", "lorem", ["ipsum", "dolor"], ["sit", "amet"], "consectetuer");
mvindex(LIST, INDEX)
Returns the element at the list at the index.
- Function Input
- input: collection<R>
- This function accepts a collection of type R. R can be integers, strings, lists, etc.
- index: integer
- Function Output
- R
- This function outputs an element of the list.
Argument | Input | Description |
---|---|---|
input | collection<R> | A list of type R, where R is any type. For example, the input of this function can be a list of strings, list of numbers, list of maps, list of lists, or a list of mixed types. |
index | integer | The index number of the element to get from the input list. Indexes start at zero. If you have 5 values in the list, the first value has an index of 0. The second values has an index of 1. Index numbers can be negative. -1 gets the last element in a list, -2 gets the second to last element in a list, and so on. If the index is out of range or does not exist, returns null. |
1. SPL2 example
Returns "a"
.
...| eval n=mvindex(["a"], 0);
2. SPL2 example
Returns "a"
.
...| eval n=mvindex(["a"], -1);
3. SPL2 example
Returns "c"
.
| eval n=mvindex(["a", "b", "c"], 2);
4. SPL2 example
Returns "a"
.
...|eval n=mvindex(["a", "b", "c"], -3);
5. SPL2 example
Returns [3,4]
.
...| eval n=mvindex([[1,2], [3, 4]], 1);
6. SPL2 example
Returns null
.
| eval n=mvindex(["a"], -2);
7. SPL2 example
In this example, if the incoming record contained a field called list
with [[100, 101], [0, 1, 2]]
, return a new list in results
with value [101, 2]
.
...| eval results=for_each(iterator(list, "x"), mvindex(x, -1));
mvjoin(STR, LIST)
This function takes two arguments, a string delimiter (STR) and a list (LIST). The function concatenates the individual values within LIST using the value of STR as a delimiter.
- Function Input
- delimiter: string
- values: collection<string>
- This function accepts a collection of lists, where the list is a string type.
- Function Output
- string
SPL2 example
Returns foo OR bar OR baz.
...| eval n=mvjoin(" OR ", ["foo", "bar", "baz"]);
mvrange(X,Y,Z)
This function returns a list for a range of numbers. This function can contain up to three arguments: a starting number X, an ending number Y (which is excluded from the field), and an optional step increment Z. Z defaults to 1. We support Splunk relative time strings as a valid step increment Z. See the third SPL2 example for usage and time modifiers in the Splunk Search Reference for the full list of time modifiers.
- Function Input
- number
- Function Output
- collection<R>
- This function outputs a collection of records of type R, where R is the same type as the function input or, when there are multiple numeric argument types, the highest of the types in the following hierarchy: Double > Float > Long > Integer.
1. SPL2 example
Returns the list [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
.
...| eval n= mvrange(1, 11);
2. SPL2 example
Returns the list [1, 3, 5, 7, 9]
.
...| eval n=mvrange(1, 11, 2);
3. SPL2 example
Returns the list [0L, 2000L, 4000L, 6000L, 8000L]
. The elements of the returned list are type "Long" instead of "Integer", because the time modifier 2s
is converted to a "Long" data type and "Long" is higher in the type priority: Double > Float > Long > Integer.
...| eval n=mvrange(0, 10000, "2s");
mvsort(X)
This function takes a list X and returns list X with the values sorted lexicographically.
- Function Input
- collection<R>
- This function accepts a collection R, where R must have a lexicographic ordering.
- Function Output
- collection<R>
- This function outputs a collection of type R, where R is the same type as the function input.
Lexicographical order sorts items based on the values used to encode the items in computer memory. In Splunk software, this is almost always UTF-8 encoding, which is a superset of ASCII.
- Numbers are sorted before letters. Numbers are sorted based on the first digit. For example, the numbers 10, 9, 70, 100 are sorted lexicographically as 10, 100, 70, 9.
- Uppercase letters are sorted before lowercase letters.
- Symbols are not standard. Some symbols are sorted before numeric values. Other symbols are sorted before or after letters.
- Null values are sorted as the string "null".
SPL2 example
Returns the list [1, 100, 11]
.
...| eval n=mvsort([1, 11, 100]);
split(X, "Y")
This function takes two arguments, a string X and a delimiter Y to use for splitting the string. It splits the values of X on the delimiter Y, where delimiter Y is either a fixed string or a Java regular expression. Returns a list of strings.
- Function Input
- str: string to split
- delim: Delimiter used to split the string. Can be either a Java regular expression or a fixed string.
- Function Output
- string
1. SPL2 example
This function takes the string argument "a,b,c"
and splits the string on the delimiter ,
. Returns ["a","b","c"]
.
... | eval n=split("a,b,c", ",");
2. SPL2 example
This function takes the string argument "one::two::three::"
and splits the string on the delimiter ::
. Returns ["one","two","three",""]
.
... | eval n=split("one::two::three::", "::");
3. SPL2 example
This function takes the string argument "a,b, c"
and splits the string on the regular expression delimiter. Returns ["a","b","c"]
.
... | eval n=split("a,b, c", /,\s*/);
4. SPL2 example
This function takes the string argument "ambM c"
and splits the string on the regular expression delimiter. Returns ["a", "b", "c"]
.
... | eval n=split("ambM c", /(?i)M\s*/);
5. SPL2 example
This function takes the string argument "a,b,c"
and splits the string using an empty string delimiter. Returns ["a,b,c"]
as a single entry list.
... | eval n=split("a,b,c", "");
6. SPL2 example
This function takes the string argument ",,"
and splits the string on the delimiter ,
. Returns ["","",""]
.
... | eval n=split(",,", ",");
Iterator | Map |
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.1.0, 1.1.0
Feedback submitted, thanks!