Splunk Search

Is there any way to display single accurate values within each cell of the table?

Sss
Path Finder

I have used search query like this-

| savedsearch REPORT1

|chart values(COLUMN3) AS Status BY COLUMN2 PROCESS_ID| fillnull value="_"|table COLUMN2 VAL1 VAL2 VAL3 VAL4 VAL5 VAL6 VAL7......

and I got result like below,

Sss_0-1686655342493.png

here,the values are repeated within each cell(i.e;few cells are having multiple values say '_' & 'F') and few columns are null.

Is there any way to display single accurate values within each cell of the table.

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

|chart values(eval(if(COLUMN3="_",null(),COLUMN3))) AS Status BY COLUMN2 PROCESS_ID| fillnull value="_"|table COLUMN2 VAL1 VAL2 VAL3 VAL4 VAL5 VAL6 VAL7......

Sss
Path Finder

I tried this but got the same result.

 

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...