Hello! If I have this:
Letter | Number |
A | 1 |
A | 2 |
A | 3 |
B | 1 |
B | 2 |
is there a way to get this:
Letter | Number |
A | 1 |
2 | |
3 | |
B | 1 |
2 |
so that the transition from one set of related rows to the next is clear?
Interesting question. Most people want to fill in blanks so Splunk offers the fillnull and filldown commands. There are no commands for the reverse, however.
You can accomplish the task using streamstats to count the rows by Letter and eval to replace the Letter with an empty string for all but the first row for each Letter.
| streamstats count by Letter
| eval Letter=if(count==1, Letter, "")
Interesting question. Most people want to fill in blanks so Splunk offers the fillnull and filldown commands. There are no commands for the reverse, however.
You can accomplish the task using streamstats to count the rows by Letter and eval to replace the Letter with an empty string for all but the first row for each Letter.
| streamstats count by Letter
| eval Letter=if(count==1, Letter, "")
That worked nicely, thank you!