Splunk Search

How to expand the row in a table without expanding the respected rows

Veeru
Path Finder

Hello,
I have table below I want to expand the ERRORS row without expanding  names column 

nameserrors
B3
4
5
C1
3
D3
4
5
E1
5

I want the o/p to be in this form

nameserrors
B3
 4
 5
c1

 

 

 

Thank You!
Happy Splunking!

Labels (3)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could expand errors with mvexpand, then use streamstats to copy the name to the next event, then clear the name if it is equal to the previous name.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...