Splunk Search

Is there any way to display single accurate values within each cell of the table?

Sss
Path Finder

I have used search query like this-

| savedsearch REPORT1

|chart values(COLUMN3) AS Status BY COLUMN2 PROCESS_ID| fillnull value="_"|table COLUMN2 VAL1 VAL2 VAL3 VAL4 VAL5 VAL6 VAL7......

and I got result like below,

Sss_0-1686655342493.png

here,the values are repeated within each cell(i.e;few cells are having multiple values say '_' & 'F') and few columns are null.

Is there any way to display single accurate values within each cell of the table.

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

|chart values(eval(if(COLUMN3="_",null(),COLUMN3))) AS Status BY COLUMN2 PROCESS_ID| fillnull value="_"|table COLUMN2 VAL1 VAL2 VAL3 VAL4 VAL5 VAL6 VAL7......

Sss
Path Finder

I tried this but got the same result.

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...