Splunk Search

how to re-arrange the column values to corresponding rows in table

satish_tblocks
New Member

Hi All,

i have created the table & table is in below format...alt text

i need to display the table like below format..
alt text

Can some please provide us the solution, how to achieve in this scenario...

Thanks,
gmvs

Tags (1)
0 Karma

consultanteIman
New Member

hello,

If the values of the table are frozen, I think you can go through this solution :

| eval Approved=if((Approved=="NULL" OR isnull(Approved)),0,Approved)| eval "Email values"=if((Email=="NULL" OR isnull(Email)),0,Email) | eval "PDF values"=if(("PDF values"=="NULL" OR isnull("PDF values")),0,"PDF values") |eval Area=if(SNO=="3" AND Area=="CA","PR",Area)|dedup Area |table SNO,Area,Approved,"PDF values","Email values"

0 Karma

FrankVl
Ultra Champion

What is the logic behind this transformation? I get the replacing NULL and empty fields by 0, but you're also moving some stuff around, based on what logic? You seem to completely ignore the first column?

So something like:

| eval Approved=if(Approved=="<NULL>" OR Approved=="",0,Approved)
| eval "PDF Values"=if('PDF Values'=="<NULL>" OR 'PDF Values'=="",0,'PDF Values')
| eval "Email Vales"=if('Email Vales'=="<NULL>" OR 'Email Vales'=="",0,'Email Vales')
| stats sum(Approved) as Approved sum("PDF Values") as "PDF Values" sum("Email Vales") as "Email Vales" by Area

Only thing is that will remove the first column. But since you seem to ignore that anyway, perhaps that is OK?

0 Karma

satish_tblocks
New Member

Hi,

please ignore the NULL values, i need to move the "All 3 field values of Approved, PDF Values, Email Vales" to corresponding Area level only like,

Area CA=11 for Approved in first row &
Area DE=19 for Email Values in second row &
Area NJ=43 for Approved in sixth row......etc, (like in given table format) want to move the each corresponding "Area" values...

please provide us the solution...

Thanks,
gmvs

0 Karma

FrankVl
Ultra Champion

Yeah, so you're summarizing by Area basically? (and cleaning up null/empty to be 0). Have you tried my solution? Because I think it does just that 🙂

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...