Splunk Search

Is there any way to display single accurate values within each cell of the table?

Sss
Path Finder

I have used search query like this-

| savedsearch REPORT1

|chart values(COLUMN3) AS Status BY COLUMN2 PROCESS_ID| fillnull value="_"|table COLUMN2 VAL1 VAL2 VAL3 VAL4 VAL5 VAL6 VAL7......

and I got result like below,

Sss_0-1686655342493.png

here,the values are repeated within each cell(i.e;few cells are having multiple values say '_' & 'F') and few columns are null.

Is there any way to display single accurate values within each cell of the table.

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

|chart values(eval(if(COLUMN3="_",null(),COLUMN3))) AS Status BY COLUMN2 PROCESS_ID| fillnull value="_"|table COLUMN2 VAL1 VAL2 VAL3 VAL4 VAL5 VAL6 VAL7......

Sss
Path Finder

I tried this but got the same result.

 

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...