topic teble fillnull in Splunk Search

teble fillnull

senthilgoa — Wed, 09 Apr 2014 15:24:47 GMT

I want to make empty cell in splunk table

Name Time Day

xxx 11.0 1
xxx 1
xxx 1
yyy 12.0 2
yyy 2
yyy 12.0 2

Re: teble fillnull

lukejadamec — Wed, 09 Apr 2014 15:59:30 GMT

Empty as in truely null, or would a space work?

Re: teble fillnull

senthilgoa — Wed, 09 Apr 2014 16:16:43 GMT

we need an empty value
Using evaluation we can able to make an empty cell

eval count = if(count<= 104307," ", count)
but how should be dynamically checking for every repeated host except top host value, that we need to be analyzing

actual Resulat
host count
aaa 111
aaa 100
aaa 090
bbb 102
bbb 100
bbb 102
bbb 099
ccc 120
ccc 110

Expected results

host count
aaa 111
aaa

aaa

bbb 102
bbb

bbb

bbb

ccc 120
ccc

Re: teble fillnull

somesoni2 — Wed, 09 Apr 2014 16:57:23 GMT

Try this (append to your existing search)

..your base search giving host,count | streamstats count as sno by host | eval count=if(sno>1,"",count) | fields - sno