Splunk Search

How to place one value in the last column of a table and replace the duplicate values as "N/A"?


| inputlookup Roster.csv

Level 1 Manager Level 2 Manager Level 3 Manager
Ganesh          Ganesh          Ganesh

The result should be like this

Level 1 Manager  Level 2 Manager  Level 3 Manager
N/A              N/A              Ganesh

Like this i have 13,000 rows.. So i need to work on this to make sure that for every row, the matching results should be eliminated and the value is to be in the final row and the remaining values should be N/A.

0 Karma


Lets say the field names are level1manager , level2manager and level3manager then how about trying this:

| inputlookup Roster.csv
| eval level1manager=if(level1manager=level2manager,  "N/A", level1manager )
| eval level2manager=if(level2manager=level3manager, "N/A", level2manager )
| table level1manager , level2manager , level3manager 
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...