mvcount of the field you're looking at. So in this case, you'd add a clause that says:
| where mvcount(FIELD_VALUE)!=1
See http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/CommonEvalFunctions and check out the various
mv* functions you can use on multivalued fields.
@aweitzman beautiful as always; thanks! Especially appreciate how you give the relevant splunk doc links as well.
Consider looking at the
eventcount field produced by the
transaction command as well.