How to hide rows based on the number of rows returned from a transaction search?

[sjanwity]

How do I hide rows based on the number of rows returned in a transaction?

(EDITED: removed all the contextual information as it wasn't needed)

[aweitzman · Accepted solution]

Check the mvcount of the field you're looking at. So in this case, you'd add a clause that says: | where mvcount(FIELD_VALUE)!=1

See http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/CommonEvalFunctions and check out the various mv* functions you can use on multivalued fields.

[martin_mueller]

Consider looking at the eventcount field produced by the transaction command as well.

[sjanwity]

@aweitzman beautiful as always; thanks! Especially appreciate how you give the relevant splunk doc links as well.