Keep transactions without duplicates without TRANSACTION or DEDUP

[splunked38]

Hi,

I'm currently using the expensive transaction command to keep transactions without any duplicates.

So if I had
a
b
c
c
d
d
d

this would return
a
b

sourcetype... | transaction name keepevicted=true | search eventcount=1

I'm trying to use:

search sourcetype=... | streamstats count by name

Which will give me a new field 'count' however I can't use where count>1 as one of the duplicates still remain.
I've hit a mental block, any ideas?

Can't use dedup for the same problem, one instance will still remain.

Thanks in advance.

[somesoni2]

Here you go

your base search | eventstats count by name | where count=1

[splunked38]

Thanks but sorry, this does not meet the spec.

If a duplicate is found, remove all entries.