Please see picture below. I inserted dedup for job_duration, but it was not showing in the search result. I only need one result to do visualisation.


  • 2
    There's not enough information in the picture to give you an answer. Looking at the query I'd guess it's breaking at either the spath or where commands - i doubt both of those commands would work on the same field. Run the query up to those points and check the expected fields are present and update your question. Also paste your splunk query as text in your question. – MisterSmith Sep 26 '19 at 13:38

It looks like job_min is a multi-value field, which are not supported by dedup. Try ... | eval job_min=mvdedup(duration) | ....

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.