Reporting

How to create pivot table containing some empty values?

Splunker2018
New Member

Hello. I've got a problem.

I have a logfile.
And I would like to create a pivot table (url, referer) and export it to csv.
But there is one problem: some refs are empty.
Then splunk.... exports only these rows where ref is not empty. So, instead of including all rows, the exported CSV contains only ~5%,

How to fix it?
Thank you in advance for your help

Tags (2)
0 Karma

DalJeanis
Legend

I don't think the term "pivot table" is relevant. You just need a cross reference table. Try this...

your search that returns the records 
| fields url referrer
| eval referrer=coalesce(referrer,"")
| stats count by url referrer
| fields - count
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...