Splunk Search

How to search CSV data to filter out events with null values in ColumnA, then only return events where values in ColumnB are found in ColumnA?


Hello All,

I have CSV data and it consists of 3 columns “Name”, “Number” and “Data”.

We need to filter out data based on the “Number” column first, and then check if the “Data” column has values which are there in the “Name” column for that particular value of “Number“ column.


Name       Number      Data
Dragonfruit  4      Chocolate
Honey          4     
Chocolate      4          Kiwi
Icecream        4    
Custardapple    4         Error
Apple          4     

and we need to first remove Data=Null
Final Output should be like this.

Name    Number  Data

Chocolate   4   Kiwi

Custardapple    4   Error

May I know how we can achieve this in a search?

Gajanan Hiroji

Tags (4)
0 Karma


Hello! Just try some thing like this

<your  base search> |were Data!=" "|table  Name Number Data


0 Karma


Hello Thanks for the reply but how do you match Data column values with Name Column values with respect to particular number?

0 Karma


Here you go:

   <your  base search> |were Data!=" "|stats values(Name) as Name, values(Data) as Data by Number|table Number  Data  Name 
0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...