Solved: transaction function and deduping mv values - Splunk Community

Splunk Search

Is there an efficient way to mvdedup on all fields at once? Result is from transaction. Rather not convert to stats if don't have too.

1 Solution

Solution

The usual way to apply a function across multiple fields at once is to use foreach. Does this give you what you're looking for?

your current search using transaction 
| foreach * 
 [ | eval <<FIELD>>=mvdedup('<<FIELD>>') ]

View solution in original post

Solution

The usual way to apply a function across multiple fields at once is to use foreach. Does this give you what you're looking for?

your current search using transaction 
| foreach * 
 [ | eval <<FIELD>>=mvdedup('<<FIELD>>') ]

Have a look at foreach command.
http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Foreach

thank you!

Get Updates on the Splunk Community!

Automated Threat Analysis: Available in ES Premier

Automated Threat Analysis: Centralize and Accelerate Phishing Investigations in Splunk Enterprise ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...