Splunk Search

teble fillnull

senthilgoa
Engager

I want to make empty cell in splunk table

Name Time Day

xxx 11.0 1
xxx 1
xxx 1
yyy 12.0 2
yyy 2
yyy 12.0 2

Tags (2)
0 Karma

somesoni2
Revered Legend

Try this (append to your existing search)

..your base search giving host,count | streamstats count as sno by host | eval count=if(sno>1,"",count) | fields - sno

senthilgoa
Engager

we need an empty value
Using evaluation we can able to make an empty cell

eval count = if(count<= 104307," ", count)
but how should be dynamically checking for every repeated host except top host value, that we need to be analyzing

actual Resulat
host count
aaa 111
aaa 100
aaa 090
bbb 102
bbb 100
bbb 102
bbb 099
ccc 120
ccc 110

Expected results

host count
aaa 111
aaa

aaa

bbb 102
bbb

bbb

bbb

ccc 120
ccc

0 Karma

lukejadamec
Super Champion

Empty as in truely null, or would a space work?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...