Splunk Search

How can i dedupe a multivalue field in props or transforms?

ruman
Splunk Employee
Splunk Employee

There are a couple of good answers here for deduping a multivalue field in a search, but how can I dedupe a multivalue field with a props or transforms (or whatever) configuration so that it happens automatically?

0 Karma

lukejadamec
Super Champion

dedup is not a props or transforms .conf attribute.

I've yet to see a way to automatically filter for duplicates, but I'm new.

Ayn
Legend

I'm older, but I approve of this message.

0 Karma

npavlidis
Engager

9 years down the line.. is this still the case? deduplication on a multi-value field is only done in search time?

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...