Splunk Search

Why dedup when we have stats values function

palisetty
Communicator

@gcusello @woodcock @richgalloway
Why do we need two functions for the same functionality?
'dedup' displays unique values while 'stats values' do the same, is there any difference other than 'stats' is transforming command and 'dedup' is not?

Tags (2)
0 Karma
1 Solution

jpolvino
Builder

stats transforms, so your original fields are no longer accessible. dedup is a great way to limit the number of rows to be used further down the line, and still have full access to the fields and their values.

View solution in original post

jpolvino
Builder

stats transforms, so your original fields are no longer accessible. dedup is a great way to limit the number of rows to be used further down the line, and still have full access to the fields and their values.

starcher
Influencer

Because there are times you want to dedup without using stats. So both commands are valid. If you are going to stats then you would be redundant to also use dedup.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...