what does dedup_splitvals argument for stats command do?

[manojsecsme]

I have a stats command in my correlation search spl which has an argument dedup_splitvals=t not sure what this argument does. Could anyone please help.

[Ranazar]

This Reddit post has this from user ItsJohnLocke:

j.ho answered this over in the Slack channel with the following: "Looks like it was introduced to fix SPL-72576: Results differ between stats/chart/timechart and tstats when grouping by a multivalued field with duplicate values per event"

I got the same answer from a Splunker that I talked to: apparently this was a bug with datamodels in a previous version of Splunk, and people generally keep this in their searches even though they're not sure if it's still needed anymore.

I usually see dedup_splitvals=t in tstats searches that have prestats=true - something like: "| tstats values(field) as field from datamodel dm prestats=true | stats dedup_splitvals=t etc. If you remove "prestats=true" then the data shows up in stats form, so ... do you really need the subsequent stats command?

[hagjos43]

Same here! I was just searching to find out what this does. Google and Splunk docs have no information on this so far. What I can comment on is that I removed the dedup_splitvals=t from my search and the data does not change.