Can you force the transaction command to keep duplicate entries in a multivalue field output?

[jaredswarren200]

I have a search using the transaction command that returns the following (as a single transaction, not as separate events)...let's call this search "searchA":

2014-04-16 22:40:22,257 MDCID=D325388-5011926287919291836 PerformanceUnitName=eMemberSearch PerformanceUnitDuration=168 
2014-04-16 22:40:22,427 MDCID=D325388-5011926287919291836 PerformanceUnitName=eAddTransaction PerformanceUnitDuration=166 
2014-04-16 22:40:22,541 MDCID=D325388-5011926287919291836 PerformanceUnitName=eAddTransaction PerformanceUnitDuration=111 
2014-04-16 22:40:22,694 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=129 
2014-04-16 22:40:22,755 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=58 
2014-04-16 22:40:22,829 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=44 
2014-04-16 22:40:22,874 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=43 
2014-04-16 22:40:22,919 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=42 
2014-04-16 22:40:22,997 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=76 
2014-04-16 22:40:23,041 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=42 
2014-04-16 22:40:23,086 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=42 
2014-04-16 22:40:23,258 MDCID=D325388-5011926287919291836 PerformanceUnitName=eUpdateCertificate PerformanceUnitDuration=169 

When I do searchA | table PerformanceUnitName, I get the following multivalue field:

eMemberSearch
eAddTransaction
eUpdateCertificate

This is unfortunate, because I actually wanted to count the number of each distinct PerformanceUnitNames in the output.

Is there any way to get the transaction command to preserve the duplicates?

[jaredswarren200]

Yes! It is, in fact.

Use the "mvlist=t" argument to the transaction command.

[martin_mueller · Accepted solution]

You're looking for mvlist=PerformanceUnitNames, see http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Transaction for reference.

[moisesroth]

The full search command answer for me was:

index="my_app" p_id=* | transaction p_id mvlist=status