Splunk Search

how to re-arrange the column values to corresponding rows in table

satish_tblocks
New Member

Hi All,

i have created the table & table is in below format...alt text

i need to display the table like below format..
alt text

Can some please provide us the solution, how to achieve in this scenario...

Thanks,
gmvs

Tags (1)
0 Karma

consultanteIman
New Member

hello,

If the values of the table are frozen, I think you can go through this solution :

| eval Approved=if((Approved=="NULL" OR isnull(Approved)),0,Approved)| eval "Email values"=if((Email=="NULL" OR isnull(Email)),0,Email) | eval "PDF values"=if(("PDF values"=="NULL" OR isnull("PDF values")),0,"PDF values") |eval Area=if(SNO=="3" AND Area=="CA","PR",Area)|dedup Area |table SNO,Area,Approved,"PDF values","Email values"

0 Karma

FrankVl
Ultra Champion

What is the logic behind this transformation? I get the replacing NULL and empty fields by 0, but you're also moving some stuff around, based on what logic? You seem to completely ignore the first column?

So something like:

| eval Approved=if(Approved=="<NULL>" OR Approved=="",0,Approved)
| eval "PDF Values"=if('PDF Values'=="<NULL>" OR 'PDF Values'=="",0,'PDF Values')
| eval "Email Vales"=if('Email Vales'=="<NULL>" OR 'Email Vales'=="",0,'Email Vales')
| stats sum(Approved) as Approved sum("PDF Values") as "PDF Values" sum("Email Vales") as "Email Vales" by Area

Only thing is that will remove the first column. But since you seem to ignore that anyway, perhaps that is OK?

0 Karma

satish_tblocks
New Member

Hi,

please ignore the NULL values, i need to move the "All 3 field values of Approved, PDF Values, Email Vales" to corresponding Area level only like,

Area CA=11 for Approved in first row &
Area DE=19 for Email Values in second row &
Area NJ=43 for Approved in sixth row......etc, (like in given table format) want to move the each corresponding "Area" values...

please provide us the solution...

Thanks,
gmvs

0 Karma

FrankVl
Ultra Champion

Yeah, so you're summarizing by Area basically? (and cleaning up null/empty to be 0). Have you tried my solution? Because I think it does just that 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...