Splunk Search

teble fillnull

senthilgoa
Engager

I want to make empty cell in splunk table

Name Time Day

xxx 11.0 1
xxx 1
xxx 1
yyy 12.0 2
yyy 2
yyy 12.0 2

Tags (2)
0 Karma

somesoni2
Revered Legend

Try this (append to your existing search)

..your base search giving host,count | streamstats count as sno by host | eval count=if(sno>1,"",count) | fields - sno

senthilgoa
Engager

we need an empty value
Using evaluation we can able to make an empty cell

eval count = if(count<= 104307," ", count)
but how should be dynamically checking for every repeated host except top host value, that we need to be analyzing

actual Resulat
host count
aaa 111
aaa 100
aaa 090
bbb 102
bbb 100
bbb 102
bbb 099
ccc 120
ccc 110

Expected results

host count
aaa 111
aaa

aaa

bbb 102
bbb

bbb

bbb

ccc 120
ccc

0 Karma

lukejadamec
Super Champion

Empty as in truely null, or would a space work?

0 Karma