https://community.splunk.com/t5/Splunk-Search/Add-row-in-table-if-value-not-present-in-the-field/m-p/561795#M195403 <P>I have a table output from Splunk Query(Not posting original values of table due to sensitive data)</P><P>Col_A&nbsp; &nbsp;Col_B&nbsp; Col_C Col_D</P><P>1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;W</P><P>2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;X</P><P>3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Y</P><P>4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Z</P><P>&nbsp;</P><P>I want to apply a search in column Col_D and if any of the among above values from Col_D is not present in the column then add row in the table.</P><P>Example :</P><P>Input:&nbsp;</P><P>Col_A&nbsp; &nbsp;Col_B&nbsp; Col_C Col_D</P><P>2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X</P><P>3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Y</P><P>&nbsp;</P><P>Expected Output :&nbsp;</P><P>&nbsp;</P><P>Col_A&nbsp; &nbsp;Col_B&nbsp; Col_C Col_D</P><P>2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X</P><P>3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Y</P><P>-&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; -&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;W not present</P><P>-&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; -&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; -&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Z not present</P> Tue, 03 Aug 2021 10:34:57 GMT ngautam760 2021-08-03T10:34:57Z https://community.splunk.com/t5/Splunk-Search/Add-row-in-table-if-value-not-present-in-the-field/m-p/561795#M195403 <P>I have a table output from Splunk Query(Not posting original values of table due to sensitive data)</P><P>Col_A&nbsp; &nbsp;Col_B&nbsp; Col_C Col_D</P><P>1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;W</P><P>2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;X</P><P>3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Y</P><P>4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Z</P><P>&nbsp;</P><P>I want to apply a search in column Col_D and if any of the among above values from Col_D is not present in the column then add row in the table.</P><P>Example :</P><P>Input:&nbsp;</P><P>Col_A&nbsp; &nbsp;Col_B&nbsp; Col_C Col_D</P><P>2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X</P><P>3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Y</P><P>&nbsp;</P><P>Expected Output :&nbsp;</P><P>&nbsp;</P><P>Col_A&nbsp; &nbsp;Col_B&nbsp; Col_C Col_D</P><P>2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X</P><P>3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Y</P><P>-&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; -&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;W not present</P><P>-&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; -&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; -&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Z not present</P> Tue, 03 Aug 2021 10:34:57 GMT https://community.splunk.com/t5/Splunk-Search/Add-row-in-table-if-value-not-present-in-the-field/m-p/561795#M195403 ngautam760 2021-08-03T10:34:57Z https://community.splunk.com/t5/Splunk-Search/Add-row-in-table-if-value-not-present-in-the-field/m-p/561804#M195408 <LI-CODE lang="markup">&lt;your search&gt; | append [| makeresults | eval Col_D=split("W,X,Y,Z",",") | mvexpand Col_D] | stats values(*) as * by Col_D | where isnull(Col_A) AND isnull(Col_B) AND isnull(Col_C) | eval Col_D=Col_D." not present"</LI-CODE> Tue, 03 Aug 2021 08:54:39 GMT https://community.splunk.com/t5/Splunk-Search/Add-row-in-table-if-value-not-present-in-the-field/m-p/561804#M195408 ITWhisperer 2021-08-03T08:54:39Z https://community.splunk.com/t5/Splunk-Search/Add-row-in-table-if-value-not-present-in-the-field/m-p/561842#M195418 <P>I tried this but on using this Its not populating the records if it matches.</P><P>Example if W is present in the table, then data of W should come in result as it is.</P> Tue, 03 Aug 2021 11:32:31 GMT https://community.splunk.com/t5/Splunk-Search/Add-row-in-table-if-value-not-present-in-the-field/m-p/561842#M195418 ngautam760 2021-08-03T11:32:31Z https://community.splunk.com/t5/Splunk-Search/Add-row-in-table-if-value-not-present-in-the-field/m-p/561848#M195421 <LI-CODE lang="markup">| append [| makeresults | eval Missing_D=split("W,X,Y,Z",",") | mvexpand Missing_D | table Missing_D] | eventstats values(Col_D) as Present_D | eval Missing_D=if(isnull(mvfind(Present_D,Missing_D)),Missing_D,null()) | where isnotnull(Missing_D) OR isnotnull(Col_A) OR isnotnull(Col_B) OR isnotnull(Col_C) OR isnotnull(ColD) | fields - Present_D</LI-CODE> Tue, 03 Aug 2021 11:50:19 GMT https://community.splunk.com/t5/Splunk-Search/Add-row-in-table-if-value-not-present-in-the-field/m-p/561848#M195421 ITWhisperer 2021-08-03T11:50:19Z