topic Re: Push the row-data to upper rows of the same column if the upper-rows are empty. in Splunk Enterprise

Push the row-data to upper rows of the same column if the upper-rows are empty.

abhishekpatel2 — Wed, 17 Mar 2021 09:03:39 GMT

Currently I am having some blank cell or null data in some row. So how can I fill that cells or rows with the data that is in below row of that columns:

Currently my output for the query is:

The Output that I want is:-

Can someone please help me with this..

Re: Push the row-data to upper rows of the same column if the upper-rows are empty.

aasabatini — Wed, 17 Mar 2021 09:57:09 GMT

you can use "Sort" comand to order your output.

In addiction you can use fillnull comand to fill your blank fields

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fillnull

Re: Push the row-data to upper rows of the same column if the upper-rows are empty.

abhishekpatel2 — Wed, 17 Mar 2021 10:02:45 GMT

It only fill that field with null in case of fill null and sort columns if I use sort. But I want to push the row data to upwards to remove the blank rows.

Re: Push the row-data to upper rows of the same column if the upper-rows are empty.

aasabatini — Wed, 17 Mar 2021 10:12:00 GMT

In your case you need to use at the end of your search:

| sort -a (field)