Splunk Search

Can i show and hide columns on a table based on values?

royimad
Builder

Hello,

I have a table with 4 Header:
A B C D
I need to show A C D column if B is null and B C D column if A is null, how to do that?

Search:
some selection | table A B C D

0 Karma
1 Solution

kristian_kolb
Ultra Champion

Not really sure that it fits with your requirements and underlying events, but eval's coalesce function may be the thing you're looking for. It will assign the new field the first non-null value of the fields listed.

Event1: A= B=2 C=3 D=4
Event2: A=1 B= C=3 D=4

search:

... | eval First = coalesce(A,B) | table First C D 

result:

First   C   D
    2   3   4
    1   3   4

Hope this helps,

Kristian

View solution in original post

kristian_kolb
Ultra Champion

Not really sure that it fits with your requirements and underlying events, but eval's coalesce function may be the thing you're looking for. It will assign the new field the first non-null value of the fields listed.

Event1: A= B=2 C=3 D=4
Event2: A=1 B= C=3 D=4

search:

... | eval First = coalesce(A,B) | table First C D 

result:

First   C   D
    2   3   4
    1   3   4

Hope this helps,

Kristian

royimad
Builder

Thanks,
Roy

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...