https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-remove-the-header-in-after-transposing/m-p/240200#M46667 <P>... | rename Metrics as " " Value as " "</P> <P>Try that, or do space dot space, etc. I'm putting more than one space between the second quotes but the forum is changing to one space</P> Fri, 06 May 2016 14:23:41 GMT jkat54 2016-05-06T14:23:41Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-remove-the-header-in-after-transposing/m-p/240196#M46663 <P>I am using the untable command instead of transpose and my result looks like </P> <P>Metrics Value <BR /> cpu_core 4<BR /> ram_size 8</P> <P>Can i use any command so that i don't get the header itself. My result must look like(after removing header Metrics and Value) </P> <P>cpu_core 4<BR /> ram_size 8 </P> Tue, 29 Sep 2020 09:39:17 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-remove-the-header-in-after-transposing/m-p/240196#M46663 Sampathu 2020-09-29T09:39:17Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-remove-the-header-in-after-transposing/m-p/240197#M46664 <P>Do these two columns have names? You could try <CODE>| search col2!="Value"</CODE></P> <P>Out of curiosity, why are you using <CODE>untable</CODE> or <CODE>transpose</CODE> command? You should be able to get the desired result with just the <CODE>table</CODE> command like this <CODE>table Metric Value</CODE></P> Fri, 06 May 2016 13:14:36 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-remove-the-header-in-after-transposing/m-p/240197#M46664 sundareshr 2016-05-06T13:14:36Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-remove-the-header-in-after-transposing/m-p/240198#M46665 <P>No. In my actual search the result is</P> <P>cpu_core ram_size<BR /> 4 8 </P> <P>query = original search......... | untable _time Metrics Value... (I know how to remove the _time field )<BR /> when I untable them i get it as </P> <P>Metrics Value<BR /> cpu_core 4<BR /> ram_size 8 </P> <P>Am curious to know whether we can remove the headers itself!! </P> Tue, 29 Sep 2020 09:39:20 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-remove-the-header-in-after-transposing/m-p/240198#M46665 Sampathu 2020-09-29T09:39:20Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-remove-the-header-in-after-transposing/m-p/240199#M46666 <P>What visualization you're try to use? If you're using table, then a table need it's header/column name. You can try html visualization in you can you need custom visualization.</P> Fri, 06 May 2016 14:15:29 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-remove-the-header-in-after-transposing/m-p/240199#M46666 somesoni2 2016-05-06T14:15:29Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-remove-the-header-in-after-transposing/m-p/240200#M46667 <P>... | rename Metrics as " " Value as " "</P> <P>Try that, or do space dot space, etc. I'm putting more than one space between the second quotes but the forum is changing to one space</P> Fri, 06 May 2016 14:23:41 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-remove-the-header-in-after-transposing/m-p/240200#M46667 jkat54 2016-05-06T14:23:41Z