Dashboards & Visualizations

How to add empty row after each unique value in a field?

dzyfer
Path Finder

My data currently looks like this:

DateName
2022-11-01ABC
2022-11-01DEF
2022-11-01GHI
2022-11-02JKL
2022-11-02MNO
2022-11-03PQR
2022-11-03STU
2022-11-03VWX
2022-11-03YZ1

 

I would like it to look like this:

DateName
2022-11-01ABC
2022-11-01DEF
2022-11-01GHI
  
2022-11-02JKL
2022-11-02MNO
  
2022-11-03PQR
2022-11-03STU
2022-11-03VWX
2022-11-03YZ1

 

I need an empty row to be inserted whenever the Date differs from the value before it.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| appendpipe 
    [| stats count by Date]
| fillnull value=0 count
| sort 0 Date count
| eval Date=if(count>0,null(),Date)
| fields - count

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| appendpipe 
    [| stats count by Date]
| fillnull value=0 count
| sort 0 Date count
| eval Date=if(count>0,null(),Date)
| fields - count
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dzyfer,

could you share your search?

by default isn't possible, but it's possible to find a workaround.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...