Splunk Search

How to add a row in a table based on the value of the cell?

fperalde
Engager

Hello,

Here is my data! Basically everything is in the same table, however I separated to better explain my problem! 

number

customer

ref

1

1

A

2

1

B

3

1

C

4

2

D

 

number

customer

ref

2-1

X

B

2-2

X

B

3-1

X

C

 

I would like a table that groups all the data as you can see here, with an order as you can see made by a correlation on the "ref" :

number

customer

ref

1

1

A

2

1

B

2-1

X

B

2-2

X

B

3

1

C

3-1

X

C

4

2

D

 

I have already tried many things, the map, the append, the foreach, etc. 

Do you have any ideas?

Thank you

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Does this give you what you want?

| sort 0 ref number

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Does this give you what you want?

| sort 0 ref number
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...