Splunk Search

How to place one value in the last column of a table and replace the duplicate values as "N/A"?

iamkilarunaresh
Explorer

| inputlookup Roster.csv

Level 1 Manager Level 2 Manager Level 3 Manager
Ganesh          Ganesh          Ganesh

The result should be like this

Level 1 Manager  Level 2 Manager  Level 3 Manager
N/A              N/A              Ganesh

Like this i have 13,000 rows.. So i need to work on this to make sure that for every row, the matching results should be eliminated and the value is to be in the final row and the remaining values should be N/A.

0 Karma

gokadroid
Motivator

Lets say the field names are level1manager , level2manager and level3manager then how about trying this:

| inputlookup Roster.csv
| eval level1manager=if(level1manager=level2manager,  "N/A", level1manager )
| eval level2manager=if(level2manager=level3manager, "N/A", level2manager )
| table level1manager , level2manager , level3manager 
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...