topic Re: How to remove only a single value when there are more multiple same values are present in a field? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-remove-only-a-single-value-when-there-are-more-multiple/m-p/280442#M84642 <P>Try this..</P> <PRE><CODE>.... | streamstats count | mvexpand mvfieldinkvstore | dedup count mvfieldinkvstore | mvcombine mvfieldinkvstore | fields - count </CODE></PRE> Fri, 03 Jun 2016 19:34:10 GMT sundareshr 2016-06-03T19:34:10Z How to remove only a single value when there are more multiple same values are present in a field? https://community.splunk.com/t5/Splunk-Search/How-to-remove-only-a-single-value-when-there-are-more-multiple/m-p/280440#M84640 <P>Hi ,</P> <P>I am trying to update a multivalued field in a KV store. So let's say there are 3 values in the field:</P> <P>A,B,A. During the update, I would want to remove A from the field. However, I want to remove only one instance of A and not all the instances.</P> <P>Can anyone help me out with how to implement this logic in Splunk?</P> Fri, 03 Jun 2016 19:11:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-only-a-single-value-when-there-are-more-multiple/m-p/280440#M84640 diliptmonson 2016-06-03T19:11:13Z Re: How to remove only a single value when there are more multiple same values are present in a field? https://community.splunk.com/t5/Splunk-Search/How-to-remove-only-a-single-value-when-there-are-more-multiple/m-p/280441#M84641 <P>Have look at the <CODE>eval-mvdedup</CODE> command</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/CommonEvalFunctions#Multivalue_functions">http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/CommonEvalFunctions#Multivalue_functions</A></P> Fri, 03 Jun 2016 19:33:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-only-a-single-value-when-there-are-more-multiple/m-p/280441#M84641 somesoni2 2016-06-03T19:33:36Z Re: How to remove only a single value when there are more multiple same values are present in a field? https://community.splunk.com/t5/Splunk-Search/How-to-remove-only-a-single-value-when-there-are-more-multiple/m-p/280442#M84642 <P>Try this..</P> <PRE><CODE>.... | streamstats count | mvexpand mvfieldinkvstore | dedup count mvfieldinkvstore | mvcombine mvfieldinkvstore | fields - count </CODE></PRE> Fri, 03 Jun 2016 19:34:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-only-a-single-value-when-there-are-more-multiple/m-p/280442#M84642 sundareshr 2016-06-03T19:34:10Z