Splunk Search

How to search CSV data to filter out events with null values in ColumnA, then only return events where values in ColumnB are found in ColumnA?

gajananh999
Contributor

Hello All,

I have CSV data and it consists of 3 columns “Name”, “Number” and “Data”.

We need to filter out data based on the “Number” column first, and then check if the “Data” column has values which are there in the “Name” column for that particular value of “Number“ column.

Ex.

Name       Number      Data
Dragonfruit  4      Chocolate
Honey          4     
Chocolate      4          Kiwi
Icecream        4    
Custardapple    4         Error
Apple          4     

and we need to first remove Data=Null
Final Output should be like this.

Name    Number  Data

Chocolate   4   Kiwi

Custardapple    4   Error

May I know how we can achieve this in a search?

Thanks
Gajanan Hiroji

Tags (4)
0 Karma

stephanefotso
Motivator

Hello! Just try some thing like this

<your  base search> |were Data!=" "|table  Name Number Data

Thanks

SGF
0 Karma

gajananh999
Contributor

Hello Thanks for the reply but how do you match Data column values with Name Column values with respect to particular number?

0 Karma

stephanefotso
Motivator

Here you go:

   <your  base search> |were Data!=" "|stats values(Name) as Name, values(Data) as Data by Number|table Number  Data  Name 
SGF
0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...