topic How can I dedup across rows and columns in a pivot table? in Splunk Search

How can I dedup across rows and columns in a pivot table?

ereed18 — Thu, 26 Jan 2017 02:00:57 GMT

I have a pivot table with data, but I need to find the number of times these values occur. However, a user can input the same value in different fields causing the same value to appear on different rows and in different columns. How can I dedup across all rows and columns to return the single value and total count it occurs?

For example:

Pivot

Col1         Col2             Col3
Here         NULL             NULL
NULL         There            Anywhere
Here         NULL             Here
Here         Here             NULL

Re: How can I dedup across rows and columns in a pivot table?

somesoni2 — Thu, 26 Jan 2017 20:21:13 GMT

Assuming you want to find the count of a specific string in all rows and columns, try this.

your current search giving output mentioned in the question 
| eval temp=1 | untable temp colname colvalue | where colvalue="YourSpecificString"
| stats count

Re: How can I dedup across rows and columns in a pivot table?

aaraneta_splunk — Sun, 12 Feb 2017 05:34:13 GMT

@ereed18 - Were you able to test out somesoni2's solution? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!