Splunk Search

How to place one value in the last column of a table and replace the duplicate values as "N/A"?

iamkilarunaresh
Explorer

| inputlookup Roster.csv

Level 1 Manager Level 2 Manager Level 3 Manager
Ganesh          Ganesh          Ganesh

The result should be like this

Level 1 Manager  Level 2 Manager  Level 3 Manager
N/A              N/A              Ganesh

Like this i have 13,000 rows.. So i need to work on this to make sure that for every row, the matching results should be eliminated and the value is to be in the final row and the remaining values should be N/A.

0 Karma

gokadroid
Motivator

Lets say the field names are level1manager , level2manager and level3manager then how about trying this:

| inputlookup Roster.csv
| eval level1manager=if(level1manager=level2manager,  "N/A", level1manager )
| eval level2manager=if(level2manager=level3manager, "N/A", level2manager )
| table level1manager , level2manager , level3manager 
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...