Reporting

How to create pivot table containing some empty values?

Splunker2018
New Member

Hello. I've got a problem.

I have a logfile.
And I would like to create a pivot table (url, referer) and export it to csv.
But there is one problem: some refs are empty.
Then splunk.... exports only these rows where ref is not empty. So, instead of including all rows, the exported CSV contains only ~5%,

How to fix it?
Thank you in advance for your help

Tags (2)
0 Karma

DalJeanis
Legend

I don't think the term "pivot table" is relevant. You just need a cross reference table. Try this...

your search that returns the records 
| fields url referrer
| eval referrer=coalesce(referrer,"")
| stats count by url referrer
| fields - count
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...