Splunk Search

Is there any way to display single accurate values within each cell of the table?

Sss
Path Finder

I have used search query like this-

| savedsearch REPORT1

|chart values(COLUMN3) AS Status BY COLUMN2 PROCESS_ID| fillnull value="_"|table COLUMN2 VAL1 VAL2 VAL3 VAL4 VAL5 VAL6 VAL7......

and I got result like below,

Sss_0-1686655342493.png

here,the values are repeated within each cell(i.e;few cells are having multiple values say '_' & 'F') and few columns are null.

Is there any way to display single accurate values within each cell of the table.

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

|chart values(eval(if(COLUMN3="_",null(),COLUMN3))) AS Status BY COLUMN2 PROCESS_ID| fillnull value="_"|table COLUMN2 VAL1 VAL2 VAL3 VAL4 VAL5 VAL6 VAL7......

Sss
Path Finder

I tried this but got the same result.

 

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...