topic Re: Change Row Values to Column Headings in Splunk Search

Change Row Values to Column Headings

IRHM73 — Wed, 15 Mar 2017 09:15:58 GMT

Hi, I wonder whether someone may be able to help me please.

I'm using the query below which extracts a column of fields associated with the index and auditSource:

(index=main) OR (index=dg_<indexname>) auditSource=<fieldvalue>
| fieldsummary 
| where like(field, "detail.%")
| fields field
| rename field as data

I'm trying to change this so the row values become the 'column' headers.

I've tried using the 'transpose' command (below and also the 'chart over', but I can get neither to work

(index=main) OR (index=dg_tax-credits-submissions) auditSource=tax-credits-submissions
| fieldsummary 
| where like(field, "detail.%")
| fields field
| rename field as data
| transpose 0 header_field=data

I just wondered whether someone may be able to look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

Re: Change Row Values to Column Headings

rjthibod — Wed, 15 Mar 2017 10:14:20 GMT

The transpose command needs another column in the data in order to handle what you are trying to do. You were correct in how to use the command, but the data preparation needs a bit more. This will add a count column that ends up being the only row after transpose. After that, you can remove that or change its contents depending on your use case.

 (index=main) OR (index=dg_tax-credits-submissions) auditSource=tax-credits-submissions
| fieldsummary 
| where like(field, "detail.%")
| fields field
| rename field as data
| chart count by data
| transpose 0 header_field=data

Re: Change Row Values to Column Headings

IRHM73 — Wed, 15 Mar 2017 10:18:46 GMT

Hi @rjthibod, many thanks for coming back to me with this.

I made a slight adjustment and added a| fields - column at the end of the query.

Regards

Chris