Splunk Search

transaction function and deduping mv values

mschellhouse
Path Finder

Is there an efficient way to mvdedup on all fields at once? Result is from transaction. Rather not convert to stats if don't have too.

0 Karma
1 Solution

elliotproebstel
Champion

The usual way to apply a function across multiple fields at once is to use foreach. Does this give you what you're looking for?

your current search using transaction 
| foreach * 
 [ | eval <<FIELD>>=mvdedup('<<FIELD>>') ]

View solution in original post

0 Karma

elliotproebstel
Champion

The usual way to apply a function across multiple fields at once is to use foreach. Does this give you what you're looking for?

your current search using transaction 
| foreach * 
 [ | eval <<FIELD>>=mvdedup('<<FIELD>>') ]
0 Karma

somesoni2
Revered Legend

mschellhouse
Path Finder

thank you!

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...