What exactly does dedup_splitvals do?

vrulev_algn — Tue, 18 Aug 2020 10:52:51 GMT

Hi,

I can't grasp the concept of dedup_splitvals. I was writing search for a pie chart on my dashboard, something like this:

index=* ... | stats count by field1, field2, field3

It returns a table, let's say it looks like this:

field1	field2	field3	count
a	b		8
a	c		4
		d	150
		e	25

When I click on first row, I see only 2 events, while the count in stats says 8. This was driving me crazy for hours.

I've stumbled upon dedup_splitvals in documentation and decided to add it to my stats command:

index=* ... | stats count by field1, field2, field3 dedup_splitvals=true

And it worked like a charm! Counts in the table are now equal to the number of events in the search. But I still don't understand what's going on.

Documentation says:
Syntax: dedup_splitvals=<boolean>
Description: Specifies whether to remove duplicate values in multivalued BY clause fields.

What does this mean? What kind of duplicate values? Can anyone explain this?

topic What exactly does dedup_splitvals do? in Splunk Search

What exactly does dedup_splitvals do?