Splunk Search

teble fillnull

Engager

I want to make empty cell in splunk table

Name Time Day

xxx 11.0 1
xxx 1
xxx 1
yyy 12.0 2
yyy 2
yyy 12.0 2

Tags (2)
0 Karma

Revered Legend

Try this (append to your existing search)

..your base search giving host,count | streamstats count as sno by host | eval count=if(sno>1,"",count) | fields - sno

Engager

we need an empty value
Using evaluation we can able to make an empty cell

eval count = if(count<= 104307," ", count)
but how should be dynamically checking for every repeated host except top host value, that we need to be analyzing

actual Resulat
host count
aaa 111
aaa 100
aaa 090
bbb 102
bbb 100
bbb 102
bbb 099
ccc 120
ccc 110

Expected results

host count
aaa 111
aaa

aaa

bbb 102
bbb

bbb

bbb

ccc 120
ccc

0 Karma

Super Champion

Empty as in truely null, or would a space work?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!