This Reddit post has this from user ItsJohnLocke:
j.ho answered this over in the Slack channel with the following: "Looks like it was introduced to fix SPL-72576: Results differ between stats/chart/timechart and tstats when grouping by a multivalued field with duplicate values per event"
I got the same answer from a Splunker that I talked to: apparently this was a bug with datamodels in a previous version of Splunk, and people generally keep this in their searches even though they're not sure if it's still needed anymore.
I usually see dedup_splitvals=t in tstats searches that have prestats=true - something like: "| tstats values(field) as field from datamodel dm prestats=true | stats dedup_splitvals=t etc . If you remove "prestats=true" then the data shows up in stats form, so ... do you really need the subsequent stats command?
... View more