The mvdedup function and stats dc() command do different things. mvdedup removes duplicate entries whereas stats dc() counts unique values and does nothing to duplicates. The query below will only work with mvdedup because the stats command would not work in the same context.
index=main
| stats list(src.port), list(dst.port) count(src.ip) as COUNT by id
| eval dst.port = if(mvcount(dst.port) = COUNT, mvdedup(dst.port), dst.port)
Thank you very much for your respond!
And what if I want to apply function mvdedup to multivalue field ONLY if there are all values of dst.port are the same? Example:
1) dst.port 80 80 80 80 and COUNT 4 - mvdedup
2) dst.port 80 80 80 70 and COUNT 4 - no mvdedup
index=main
| stats list(src.port), list(dst.port) as list_dst values(dst.port) as values_dst count(src.ip) as COUNT by id
| eval list_dst=if(mvcount(values_dst)=1,values_dst,list_dst)