topic Re: Hide duplicate values in consecutive table rows in Splunk Search

How to hide duplicate values in consecutive table rows?

HarAtWork — Tue, 03 Jan 2023 16:05:52 GMT

Hello! If I have this:

Letter	Number
A	1
A	2
A	3
B	1
B	2

is there a way to get this:

Letter	Number
A	1
	2
	3
B	1
	2

so that the transition from one set of related rows to the next is clear?

Re: Hide duplicate values in consecutive table rows

richgalloway — Tue, 03 Jan 2023 14:03:06 GMT

Interesting question. Most people want to fill in blanks so Splunk offers the fillnull and filldown commands. There are no commands for the reverse, however.

You can accomplish the task using streamstats to count the rows by Letter and eval to replace the Letter with an empty string for all but the first row for each Letter.

| streamstats count by Letter | eval Letter=if(count==1, Letter, "")

Re: Hide duplicate values in consecutive table rows

HarAtWork — Tue, 03 Jan 2023 15:34:01 GMT

That worked nicely, thank you!