https://community.splunk.com/t5/Splunk-Search/What-happened-to-the-transposed-dates/m-p/470895#M132468 <P>The <CODE>transpose</CODE> command is limited to 5 rows unless you specify otherwise. RTM at <A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Transpose">https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Transpose</A></P> Fri, 10 Apr 2020 12:44:21 GMT richgalloway 2020-04-10T12:44:21Z https://community.splunk.com/t5/Splunk-Search/What-happened-to-the-transposed-dates/m-p/470894#M132467 <P>I made a query that involves transposing a timechart (span=1w, analyzing since 1/1/2020). </P> <P>The result is the exact layout I want, however, several columns representing dates after the transpose are missing (ie. nothing in February showed up). </P> <P>Is there a limit in splunk how many columns are transposed?</P> <P>Query:</P> <PRE><CODE>splunk_server=indexer* index=wsi_tax_summary sourcetype=stash intuit_tid=* intuit_offeringid=* capability=* error_msg_service=* http_status_code_host=* | timechart span=1w dc(intuit_tid) as total_requests, dc(eval(if(error_msg_service="OK", intuit_tid,null))) as total_success | sort -_time | eval _time=strftime(_time,"%m/%d/%y") | eval total_failures=total_requests-total_success | eval success_rate= ROUND((total_success/total_requests)*100,2) | transpose header_field=_time column_name=week_starting | regex week_starting!=("^_") | eval sortkey=case(week_starting="total_requests",1, week_starting="total_success", 2, week_starting="total_failures", 3, week_starting="success_rate", 4) | sort sortkey | fields - sortkey </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8661i4457A75A424F853D/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 09 Apr 2020 22:48:15 GMT https://community.splunk.com/t5/Splunk-Search/What-happened-to-the-transposed-dates/m-p/470894#M132467 hollybross1219 2020-04-09T22:48:15Z https://community.splunk.com/t5/Splunk-Search/What-happened-to-the-transposed-dates/m-p/470895#M132468 <P>The <CODE>transpose</CODE> command is limited to 5 rows unless you specify otherwise. RTM at <A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Transpose">https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Transpose</A></P> Fri, 10 Apr 2020 12:44:21 GMT https://community.splunk.com/t5/Splunk-Search/What-happened-to-the-transposed-dates/m-p/470895#M132468 richgalloway 2020-04-10T12:44:21Z https://community.splunk.com/t5/Splunk-Search/What-happened-to-the-transposed-dates/m-p/470896#M132469 <P>I totally missed that part! Thank you! Fixed <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 10 Apr 2020 22:59:52 GMT https://community.splunk.com/t5/Splunk-Search/What-happened-to-the-transposed-dates/m-p/470896#M132469 hollybross1219 2020-04-10T22:59:52Z