Splunk Search

How can I dedup across rows and columns in a pivot table?

ereed18
Engager

I have a pivot table with data, but I need to find the number of times these values occur. However, a user can input the same value in different fields causing the same value to appear on different rows and in different columns. How can I dedup across all rows and columns to return the single value and total count it occurs?

For example:

Pivot

Col1         Col2             Col3
Here         NULL             NULL
NULL         There            Anywhere
Here         NULL             Here
Here         Here             NULL
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@ereed18 - Were you able to test out somesoni2's solution? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!

0 Karma

somesoni2
Revered Legend

Assuming you want to find the count of a specific string in all rows and columns, try this.

your current search giving output mentioned in the question 
| eval temp=1 | untable temp colname colvalue | where colvalue="YourSpecificString"
| stats count
0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...