Splunk Search

How to place one value in the last column of a table and replace the duplicate values as "N/A"?

iamkilarunaresh
Explorer

| inputlookup Roster.csv

Level 1 Manager Level 2 Manager Level 3 Manager
Ganesh          Ganesh          Ganesh

The result should be like this

Level 1 Manager  Level 2 Manager  Level 3 Manager
N/A              N/A              Ganesh

Like this i have 13,000 rows.. So i need to work on this to make sure that for every row, the matching results should be eliminated and the value is to be in the final row and the remaining values should be N/A.

0 Karma

gokadroid
Motivator

Lets say the field names are level1manager , level2manager and level3manager then how about trying this:

| inputlookup Roster.csv
| eval level1manager=if(level1manager=level2manager,  "N/A", level1manager )
| eval level2manager=if(level2manager=level3manager, "N/A", level2manager )
| table level1manager , level2manager , level3manager 
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...