Splunk Search

How can i dedupe a multivalue field in props or transforms?

Splunk Employee
Splunk Employee

There are a couple of good answers here for deduping a multivalue field in a search, but how can I dedupe a multivalue field with a props or transforms (or whatever) configuration so that it happens automatically?

0 Karma

Super Champion

dedup is not a props or transforms .conf attribute.

I've yet to see a way to automatically filter for duplicates, but I'm new.

Legend

I'm older, but I approve of this message.

0 Karma