Multivalues Operations
mvappend
Description: Takes parameters separated by commas and returns a multivalue field.
Example:
... | eval res=mvappend(users, "hello", 12, pi())
mvcount
Description: Takes a parameter and returns the count of records in the multivalue field.
Example:
... | stats values(user) as users | eval x=mvcount(users)
mvdedup
Description: Takes a parameter and deduplicates the values in the multivalue field.
Example:
... | eval res=mvappend(users, "user1", "user2"), res=mvdedup(res)
mvfilter
Description: Takes a parameter and filters it based on a boolean condition.
... | eval res=mvfilter(match(users, "user1"))
... | eval res=mvfilter(in(users, "user1", "user2", "user2"))
... | eval ipa={"10.22.3.2", "192.168.0.1"}, x=mvfilter(cidrmatch("10.0.0.0/8", ipa))
... | eval myval={2, 6, 8, 10}, res=mvfilter(myval > 7)
mvfind
Description: Takes a parameter and returns the index of the first matching occurrence.
In this example, res will have the value 2.
... | eval words={"hello", "my", "world"}, res=mvfind(words, "w(.*)")
In this example, res will have the value null.
... | eval words={"hello", "my", "world"}, res=mvfind(ipa, "z(.*)")
mvindex
Description: Takes a parameter and the index number to find in a multivalue field. Returns the value or null if not found.
In this example, res will have the value my.
... | eval worlds={"hello", "my", "world"}, res=mvindex(worlds, 1)
mvjoin
Description: Takes a multivalue parameter and a concatenator, returning a string with all values concatenated by the specified delimiter.
In this example, res will have the value "hello OR my OR world".
... | eval words={"hello", "my", "world"}, x=mvjoin(words, " OR ")
mvmap
Description: Iterates over the elements of a multivalue field and applies the specified expression to each element. Returns a multivalue value composed of the results of processing the elements of the source field.
Syntax
... | eval <result_field> = mvmap(<identifier> -> <multivalue_expression>, <map_expression>)
<identifier>— the name of a temporary variable to which the next element of the multivalue field is assigned on each iteration. The name must not match any index field names or identifiers declared earlier in the query<lambda_expression>— a multivalue field or an expression whose result is a multivalue value<expression>— an expression executed for each element
Query examples
In this example, the mvappend function creates the response_times_ms multivalue field. The mvindex function selects the elements with indexes from 1 to 2. The mvmap function then iterates over the selected elements, assigns each one to the temporary variable x, and evaluates the expression x * 10.
The resulting res field will contain [2500, 4800].
... | eval response_times_ms = mvappend(120, 250, 480, 900) | eval res = mvmap(x -> mvindex(response_times_ms, 1, 2), x * 10)
In this example, the mvappend function creates a multivalue field, to which the mvsort and mvdedup functions are applied sequentially. The mvmap function then iterates over the elements of the resulting value and applies the expression round(pi() * pow(abs(x), 2), 2) to each one.
The resulting res field will contain [28.27, 12.57, 50.27, 78.54].
... | eval res = mvmap(x -> mvdedup(mvsort(mvappend(-3, 2, -3, 5, 4))), round(pi() * pow(abs(x), 2), 2))
In this example, the mvappend function creates the score multivalue field containing numeric values. The mvmap function then iterates over the field elements and checks the condition x >= 60 for each one.
The resulting res field will contain ["fail", "pass", "pass"].
... | eval score = mvappend(45, 70, 90) | eval res = mvmap(x -> score, if(x >= 60, "pass", "fail"))
mvrange
Description: Takes parameters for start, end, and increment interval (optional). Returns a multivalue field with a list of numbers according to the given parameters.
In this example, res will have the value {1, 2, 3, 4, 5}.
... | eval res=mvrange(1, 5, 1)
mvsort
Description: Takes a multivalue parameter and sorts it internally.
In this example, res will have the value {"hello", "my", "world"}.
... | eval words={"my", "world", "hello"}, res=mvsort(words)
mvzip
Description: Takes multivalue parameters and concatenates them (by index order in the multivalue field). If one parameter has more values than the others, concatenation for those values will not be completed.
In this example, res will have the value {"user1,1", "user2,2"}.
... | eval myVal={1, 2, 3}, users={"user2", "user1"}, users=mvsort(users), res=mvzip(users, myVal)
split
Description: Takes a non-multivalue string parameter and a delimiter, returning a multivalue field composed according to the delimiter.
In this example, res will have the value {"hello", "my", "world"}.
... | eval myVal="hello, my, world", res=split(myVal, ",")