Retrieve discarded values from the dedup command or other commands?

[amorales_splunk]

I want to use the dedup command and see which values it removes from a field. Is this possible?

[yuanliu]

I suppose you can calculate which ones are removed by dedup, just not by using dedup.

| eventstats last(curious) as remaining by deduping
| stats values(curious) as all by deduping remaining
| eval removed = mvmap(all, if(all == remaining, null(), all))

Here, curious is the field you want to examine, and deduping is the field on which to dedup.

[richgalloway]

Use the keepevents option to retain the duplicate events, but without the repeated field value.  Look for where the field is set to null.