https://community.splunk.com/t5/Splunk-Search/Getting-duplicate-values/m-p/61404#M15172 <P>hi,</P> <P>this is my query </P> <PRE><CODE>index=tm_idx host="server" sourcetype="TM_Test_10" | rex field=msg "(?i)TM1\sserver\sload\stime\s\(secs\)\s\=\s(?P&lt;timetakentostart&gt;\w+)" | where timetakentostart!="" | stats sum(timetakentostart),values(timetakentostart) by date_month </CODE></PRE> <P><CODE>values</CODE> gives me unique value of the field but i want duplicates also. How can i get it ?</P> <P>Thanks and Regards</P> Thu, 12 Sep 2013 06:40:02 GMT ChhayaV 2013-09-12T06:40:02Z https://community.splunk.com/t5/Splunk-Search/Getting-duplicate-values/m-p/61404#M15172 <P>hi,</P> <P>this is my query </P> <PRE><CODE>index=tm_idx host="server" sourcetype="TM_Test_10" | rex field=msg "(?i)TM1\sserver\sload\stime\s\(secs\)\s\=\s(?P&lt;timetakentostart&gt;\w+)" | where timetakentostart!="" | stats sum(timetakentostart),values(timetakentostart) by date_month </CODE></PRE> <P><CODE>values</CODE> gives me unique value of the field but i want duplicates also. How can i get it ?</P> <P>Thanks and Regards</P> Thu, 12 Sep 2013 06:40:02 GMT https://community.splunk.com/t5/Splunk-Search/Getting-duplicate-values/m-p/61404#M15172 ChhayaV 2013-09-12T06:40:02Z https://community.splunk.com/t5/Splunk-Search/Getting-duplicate-values/m-p/61405#M15173 <P>Use <CODE>list</CODE> instead of <CODE>values</CODE>.</P> Thu, 12 Sep 2013 07:18:12 GMT https://community.splunk.com/t5/Splunk-Search/Getting-duplicate-values/m-p/61405#M15173 Ayn 2013-09-12T07:18:12Z