Splunk Search

How can I dedup across rows and columns in a pivot table?

ereed18
Engager

I have a pivot table with data, but I need to find the number of times these values occur. However, a user can input the same value in different fields causing the same value to appear on different rows and in different columns. How can I dedup across all rows and columns to return the single value and total count it occurs?

For example:

Pivot

Col1         Col2             Col3
Here         NULL             NULL
NULL         There            Anywhere
Here         NULL             Here
Here         Here             NULL
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@ereed18 - Were you able to test out somesoni2's solution? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!

0 Karma

somesoni2
Revered Legend

Assuming you want to find the count of a specific string in all rows and columns, try this.

your current search giving output mentioned in the question 
| eval temp=1 | untable temp colname colvalue | where colvalue="YourSpecificString"
| stats count
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...