Dedup is not working on Splunk

Question

Please see picture below. I inserted dedup for job_duration, but it was not showing in the search result. I only need one result to do visualisation.

Answer 1

It looks like job_min is a multi-value field, which are not supported by dedup. Try ... | eval job_min=mvdedup(duration) | ....

Answer 2

If job_min is in a multivalue field, you should mvexpand first

And, instead of dedup, try using stats

Like this:

| mvexpand job_min
| stats count by job_min
| fields - count