Splunk Search

what does dedup_splitvals argument for stats command do?

manojsecsme
Explorer

I have a stats command in my correlation search spl which has an argument dedup_splitvals=t not sure what this argument does. Could anyone please help.

Tags (1)

Ranazar
Path Finder

This Reddit post has this from user ItsJohnLocke:

j.ho answered this over in the Slack channel with the following: "Looks like it was introduced to fix SPL-72576: Results differ between stats/chart/timechart and tstats when grouping by a multivalued field with duplicate values per event"

I got the same answer from a Splunker that I talked to: apparently this was a bug with datamodels in a previous version of Splunk, and people generally keep this in their searches even though they're not sure if it's still needed anymore.

I usually see dedup_splitvals=t in tstats searches that have prestats=true - something like: "| tstats values(field) as field from datamodel dm prestats=true | stats dedup_splitvals=t etc. If you remove "prestats=true" then the data shows up in stats form, so ... do you really need the subsequent stats command?

0 Karma

hagjos43
Contributor

Same here! I was just searching to find out what this does. Google and Splunk docs have no information on this so far. What I can comment on is that I removed the dedup_splitvals=t from my search and the data does not change.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...