Splunk Search

How to place one value in the last column of a table and replace the duplicate values as "N/A"?

| inputlookup Roster.csv

Level 1 Manager Level 2 Manager Level 3 Manager
Ganesh          Ganesh          Ganesh

The result should be like this

Level 1 Manager  Level 2 Manager  Level 3 Manager
N/A              N/A              Ganesh

Like this i have 13,000 rows.. So i need to work on this to make sure that for every row, the matching results should be eliminated and the value is to be in the final row and the remaining values should be N/A.

0 Karma

Motivator

Lets say the field names are level1manager , level2manager and level3manager then how about trying this:

| inputlookup Roster.csv
| eval level1manager=if(level1manager=level2manager,  "N/A", level1manager )
| eval level2manager=if(level2manager=level3manager, "N/A", level2manager )
| table level1manager , level2manager , level3manager