How to have field populate once

[Mary666]

Hello Splunk Community, 

I have encountered a easy, yet tricky situation. I was told chart command works just like stats, so far I have all the data I need. However, the issue I have is with one field. I need to populate the setting field for the data. I get the setting field to populate, but it shows up 3 different times for each drive - I only need it to show one time. 

index="123" sourcekind="Disk Space" count="% Space" dev_team=XYZ  drive="C:" OR drive="E:" OR drive="F:"  | chart values(setting) as setting  sparkline(avg(NET),15m) as NET_value,  latest(NET) as Free over server by drive

Data I receive:

server	setting:C:	setting:E:	setting:F	Free:C:	Free:E:	Free:F:	Net_Value:C:	Net_Value:E:	Net_Value:F:
123456	Testing	Testing	Tesing	23.00	24.00	34.00	\	\	\

Desired results:

server	setting	Free:C:	Free:E	Free:F	Net_Value:C:	NetValue:E:	Net_Value:F
123456	Testing	23:00	24:00	34.00	\	\	\

[renjith_nair · Accepted solution]

Since the field names are dynamic, try this method

index="123" sourcekind="Disk Space" count="% Space" dev_team=XYZ  drive="C:" OR drive="E:" OR drive="F:"  | chart values(setting) as setting  sparkline(avg(NET),15m) as NET_value,  latest(NET) as Free over server by drive
|eval settings=null()
|foreach settings:* [eval settings=if(isnull(settings),'<<FIELD>>',settings)]|fields - settings:*

[Mary666]

@renjith_nair  Thanks so much for your help. I would like to know though why you used is null for the eval function and if there is an other way of doing the for each without the null?

|foreach settings:* [eval settings=if(isnull(settings),'<<FIELD>>',settings)]|fields - settings:*

Please advise. 

[renjith_nair]

sure. I just initialized the value with null and you can use any value there. It's just for checking that we are storing the value only once i.e when it's empty since all other values are same.