0

Please see picture below. I inserted dedup for job_duration, but it was not showing in the search result. I only need one result to do visualisation.

screenshot

  • 3
    There's not enough information in the picture to give you an answer. Looking at the query I'd guess it's breaking at either the spath or where commands - i doubt both of those commands would work on the same field. Run the query up to those points and check the expected fields are present and update your question. Also paste your splunk query as text in your question. – MisterSmith Sep 26 '19 at 13:38
0

It looks like job_min is a multi-value field, which are not supported by dedup. Try ... | eval job_min=mvdedup(duration) | ....

0

If job_min is in a multivalue field, you should mvexpand first

And, instead of dedup, try using stats

Like this:

| mvexpand job_min
| stats count by job_min
| fields - count

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.