Splunk Search

How can I dedup across rows and columns in a pivot table?

ereed18
Engager

I have a pivot table with data, but I need to find the number of times these values occur. However, a user can input the same value in different fields causing the same value to appear on different rows and in different columns. How can I dedup across all rows and columns to return the single value and total count it occurs?

For example:

Pivot

Col1         Col2             Col3
Here         NULL             NULL
NULL         There            Anywhere
Here         NULL             Here
Here         Here             NULL
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@ereed18 - Were you able to test out somesoni2's solution? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!

0 Karma

somesoni2
Revered Legend

Assuming you want to find the count of a specific string in all rows and columns, try this.

your current search giving output mentioned in the question 
| eval temp=1 | untable temp colname colvalue | where colvalue="YourSpecificString"
| stats count
0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...