Dashboards & Visualizations

How to add empty row after each unique value in a field?

dzyfer
Path Finder

My data currently looks like this:

DateName
2022-11-01ABC
2022-11-01DEF
2022-11-01GHI
2022-11-02JKL
2022-11-02MNO
2022-11-03PQR
2022-11-03STU
2022-11-03VWX
2022-11-03YZ1

 

I would like it to look like this:

DateName
2022-11-01ABC
2022-11-01DEF
2022-11-01GHI
  
2022-11-02JKL
2022-11-02MNO
  
2022-11-03PQR
2022-11-03STU
2022-11-03VWX
2022-11-03YZ1

 

I need an empty row to be inserted whenever the Date differs from the value before it.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| appendpipe 
    [| stats count by Date]
| fillnull value=0 count
| sort 0 Date count
| eval Date=if(count>0,null(),Date)
| fields - count

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| appendpipe 
    [| stats count by Date]
| fillnull value=0 count
| sort 0 Date count
| eval Date=if(count>0,null(),Date)
| fields - count
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dzyfer,

could you share your search?

by default isn't possible, but it's possible to find a workaround.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...