Splunk Search

Is there any way to display single accurate values within each cell of the table?

Sss
Path Finder

I have used search query like this-

| savedsearch REPORT1

|chart values(COLUMN3) AS Status BY COLUMN2 PROCESS_ID| fillnull value="_"|table COLUMN2 VAL1 VAL2 VAL3 VAL4 VAL5 VAL6 VAL7......

and I got result like below,

Sss_0-1686655342493.png

here,the values are repeated within each cell(i.e;few cells are having multiple values say '_' & 'F') and few columns are null.

Is there any way to display single accurate values within each cell of the table.

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

|chart values(eval(if(COLUMN3="_",null(),COLUMN3))) AS Status BY COLUMN2 PROCESS_ID| fillnull value="_"|table COLUMN2 VAL1 VAL2 VAL3 VAL4 VAL5 VAL6 VAL7......

Sss
Path Finder

I tried this but got the same result.

 

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...