How can I apply mvdedup to field dst.port only if numbers of dst ports = field COUNT?

[bosseres]

Hello everyone!

I have basic search

index=main
| stats list(src.port), list(dst.port) count(src.ip) as COUNT by id

How can I apply mvdedup (or stats dc, don't know how better) to field dst.port only if numbers of dst ports = field COUNT?

[richgalloway]

The mvdedup function and stats dc() command do different things. mvdedup removes duplicate entries whereas stats dc() counts unique values and does nothing to duplicates. The query below will only work with mvdedup because the stats command would not work in the same context.

index=main 
| stats list(src.port), list(dst.port) count(src.ip) as COUNT by id 
| eval dst.port = if(mvcount(dst.port) = COUNT, mvdedup(dst.port), dst.port)

[bosseres]

Thank you very much for your respond!

And what if I want to apply function mvdedup to multivalue field ONLY if there are all values of dst.port are the same? Example:

1) dst.port 80 80 80 80 and COUNT 4 - mvdedup

2) dst.port 80 80 80 70 and COUNT 4 - no mvdedup

[ITWhisperer]

index=main 
| stats list(src.port), list(dst.port) as list_dst values(dst.port) as values_dst count(src.ip) as COUNT by id
| eval list_dst=if(mvcount(values_dst)=1,values_dst,list_dst)