transaction function and deduping mv values

[mschellhouse]

Is there an efficient way to mvdedup on all fields at once? Result is from transaction. Rather not convert to stats if don't have too.

[elliotproebstel · Accepted solution]

The usual way to apply a function across multiple fields at once is to use foreach. Does this give you what you're looking for?

your current search using transaction 
| foreach * 
 [ | eval <<FIELD>>=mvdedup('<<FIELD>>') ]

[somesoni2]

Have a look at foreach command.
http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Foreach

[mschellhouse]

thank you!