Please see picture below. I inserted dedup for job_duration, but it was not showing in the search result. I only need one result to do visualisation.
-
3There's not enough information in the picture to give you an answer. Looking at the query I'd guess it's breaking at either the spath or where commands - i doubt both of those commands would work on the same field. Run the query up to those points and check the expected fields are present and update your question. Also paste your splunk query as text in your question. – MisterSmith Sep 26 '19 at 13:38
It looks like job_min is a multi-value field, which are not supported by dedup. Try ... | eval job_min=mvdedup(duration) | ....
If job_min is in a multivalue field, you should mvexpand first
And, instead of dedup, try using stats
Like this:
| mvexpand job_min
| stats count by job_min
| fields - count
