Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Problematic mvtruncate Search Macro in SA-Utils

$
0
0
The default mvtruncate(3) macro that comes with SA_Utils 3.4.0 is eval $output$=if(mvcount($input$)>$count$,mvappend(mvindex(**src**,0,$count$-1),NULL,"...truncated..."),$input$) It makes more sense to be eval $output$=if(mvcount($input$)>$count$,mvappend(mvindex(**$input$**,0,$count$-1),NULL,"...truncated..."),$input$) so it keeps the first 'count' number of results of the respective field before truncation. e.g. The fixed 'src' value collided when combined with the Web data model from CIM where a call to the `mvtruncate(Web.dest)` was showing values from the Web.src

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>