My splunk entry is
firstName="Tom" lastName="Jerry" middleName="TJ" dob="1/1/2023" dept="mice" status="202" dept="house"
In above event, field dept is repeated (with value mice and house). I would like to find all the field names which are duplicated in single event / within the event
Tried dudep and other ways per google suggestion. But not able to get result.
Can you please help me with this. Thanks in advance.
| extract mv_add=t
| foreach *
[| eval dups=if(mvcount(<<FIELD>>) > 1, if(isnull(dups),"<<FIELD>>",mvappend(dups,"<<FIELD>>")), dups)]