https://community.splunk.com/t5/Splunk-Search/Can-you-force-the-transaction-command-to-keep-duplicate-entries/m-p/135716#M37126 <P>You're looking for <CODE>mvlist=PerformanceUnitNames</CODE>, see <A href="http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Transaction">http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Transaction</A> for reference.</P> Thu, 17 Apr 2014 23:01:47 GMT martin_mueller 2014-04-17T23:01:47Z https://community.splunk.com/t5/Splunk-Search/Can-you-force-the-transaction-command-to-keep-duplicate-entries/m-p/135715#M37125 <P>I have a search using the transaction command that returns the following (as a single transaction, not as separate events)...let's call this search "searchA":</P> <PRE><CODE>2014-04-16 22:40:22,257 MDCID=D325388-5011926287919291836 PerformanceUnitName=eMemberSearch PerformanceUnitDuration=168 2014-04-16 22:40:22,427 MDCID=D325388-5011926287919291836 PerformanceUnitName=eAddTransaction PerformanceUnitDuration=166 2014-04-16 22:40:22,541 MDCID=D325388-5011926287919291836 PerformanceUnitName=eAddTransaction PerformanceUnitDuration=111 2014-04-16 22:40:22,694 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=129 2014-04-16 22:40:22,755 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=58 2014-04-16 22:40:22,829 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=44 2014-04-16 22:40:22,874 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=43 2014-04-16 22:40:22,919 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=42 2014-04-16 22:40:22,997 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=76 2014-04-16 22:40:23,041 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=42 2014-04-16 22:40:23,086 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=42 2014-04-16 22:40:23,258 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=169 </CODE></PRE> <P>When I do <CODE>searchA | table PerformanceUnitName</CODE>, I get the following multivalue field:</P> <PRE><CODE>eMemberSearch eAddTransaction eUpdateCertificate </CODE></PRE> <P>This is unfortunate, because I actually wanted to count the number of each distinct PerformanceUnitNames in the output.</P> <P>Is there any way to get the transaction command to preserve the duplicates?</P> Thu, 17 Apr 2014 22:41:04 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-force-the-transaction-command-to-keep-duplicate-entries/m-p/135715#M37125 jaredswarren200 2014-04-17T22:41:04Z https://community.splunk.com/t5/Splunk-Search/Can-you-force-the-transaction-command-to-keep-duplicate-entries/m-p/135716#M37126 <P>You're looking for <CODE>mvlist=PerformanceUnitNames</CODE>, see <A href="http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Transaction">http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Transaction</A> for reference.</P> Thu, 17 Apr 2014 23:01:47 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-force-the-transaction-command-to-keep-duplicate-entries/m-p/135716#M37126 martin_mueller 2014-04-17T23:01:47Z https://community.splunk.com/t5/Splunk-Search/Can-you-force-the-transaction-command-to-keep-duplicate-entries/m-p/135717#M37127 <P>Yes! It is, in fact.</P> <P>Use the "mvlist=t" argument to the transaction command.</P> Thu, 17 Apr 2014 23:04:43 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-force-the-transaction-command-to-keep-duplicate-entries/m-p/135717#M37127 jaredswarren200 2014-04-17T23:04:43Z https://community.splunk.com/t5/Splunk-Search/Can-you-force-the-transaction-command-to-keep-duplicate-entries/m-p/135718#M37128 <P>The full search command answer for me was:</P> <PRE><CODE>index="my_app" p_id=* | transaction p_id mvlist=status </CODE></PRE> Wed, 17 May 2017 19:27:22 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-force-the-transaction-command-to-keep-duplicate-entries/m-p/135718#M37128 moisesroth 2017-05-17T19:27:22Z