Reporting

How to create pivot table containing some empty values?

Splunker2018
New Member

Hello. I've got a problem.

I have a logfile.
And I would like to create a pivot table (url, referer) and export it to csv.
But there is one problem: some refs are empty.
Then splunk.... exports only these rows where ref is not empty. So, instead of including all rows, the exported CSV contains only ~5%,

How to fix it?
Thank you in advance for your help

Tags (2)
0 Karma

DalJeanis
Legend

I don't think the term "pivot table" is relevant. You just need a cross reference table. Try this...

your search that returns the records 
| fields url referrer
| eval referrer=coalesce(referrer,"")
| stats count by url referrer
| fields - count
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Meet the .conf26 AI Agent Buildathon Winners

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...

Trusted Autonomy in the SOC: A Maturity Journey

AI is compressing attacker timelines and pushing SOC teams beyond human capacity thresholds. The next SOC ...

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...