Archive

what does dedup_splitvals argument for stats command do?

Engager

I have a stats command in my correlation search spl which has an argument dedup_splitvals=t not sure what this argument does. Could anyone please help.

Tags (1)

Path Finder

This Reddit post has this from user ItsJohnLocke:

j.ho answered this over in the Slack channel with the following: "Looks like it was introduced to fix SPL-72576: Results differ between stats/chart/timechart and tstats when grouping by a multivalued field with duplicate values per event"

I got the same answer from a Splunker that I talked to: apparently this was a bug with datamodels in a previous version of Splunk, and people generally keep this in their searches even though they're not sure if it's still needed anymore.

I usually see dedup_splitvals=t in tstats searches that have prestats=true - something like: "| tstats values(field) as field from datamodel dm prestats=true | stats dedup_splitvals=t etc. If you remove "prestats=true" then the data shows up in stats form, so ... do you really need the subsequent stats command?

0 Karma

Contributor

Same here! I was just searching to find out what this does. Google and Splunk docs have no information on this so far. What I can comment on is that I removed the dedup_splitvals=t from my search and the data does not change.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!