Splunk Search

how to re-arrange the column values to corresponding rows in table

satish_tblocks
New Member

Hi All,

i have created the table & table is in below format...alt text

i need to display the table like below format..
alt text

Can some please provide us the solution, how to achieve in this scenario...

Thanks,
gmvs

Tags (1)
0 Karma

consultanteIman
New Member

hello,

If the values of the table are frozen, I think you can go through this solution :

| eval Approved=if((Approved=="NULL" OR isnull(Approved)),0,Approved)| eval "Email values"=if((Email=="NULL" OR isnull(Email)),0,Email) | eval "PDF values"=if(("PDF values"=="NULL" OR isnull("PDF values")),0,"PDF values") |eval Area=if(SNO=="3" AND Area=="CA","PR",Area)|dedup Area |table SNO,Area,Approved,"PDF values","Email values"

0 Karma

FrankVl
Ultra Champion

What is the logic behind this transformation? I get the replacing NULL and empty fields by 0, but you're also moving some stuff around, based on what logic? You seem to completely ignore the first column?

So something like:

| eval Approved=if(Approved=="<NULL>" OR Approved=="",0,Approved)
| eval "PDF Values"=if('PDF Values'=="<NULL>" OR 'PDF Values'=="",0,'PDF Values')
| eval "Email Vales"=if('Email Vales'=="<NULL>" OR 'Email Vales'=="",0,'Email Vales')
| stats sum(Approved) as Approved sum("PDF Values") as "PDF Values" sum("Email Vales") as "Email Vales" by Area

Only thing is that will remove the first column. But since you seem to ignore that anyway, perhaps that is OK?

0 Karma

satish_tblocks
New Member

Hi,

please ignore the NULL values, i need to move the "All 3 field values of Approved, PDF Values, Email Vales" to corresponding Area level only like,

Area CA=11 for Approved in first row &
Area DE=19 for Email Values in second row &
Area NJ=43 for Approved in sixth row......etc, (like in given table format) want to move the each corresponding "Area" values...

please provide us the solution...

Thanks,
gmvs

0 Karma

FrankVl
Ultra Champion

Yeah, so you're summarizing by Area basically? (and cleaning up null/empty to be 0). Have you tried my solution? Because I think it does just that 🙂

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...