Please see picture below. I inserted dedup for job_duration, but it was not showing in the search result. I only need one result to do visualisation.
2 Answers
It looks like job_min is a multi-value field, which are not supported by dedup. Try ... | eval job_min=mvdedup(duration) | ....
If job_min is in a multivalue field, you should mvexpand first
And, instead of dedup, try using stats
Like this:
| mvexpand job_min
| stats count by job_min
| fields - count
