topic Re: How to rename column and row labels after using transpose? in Splunk Search

How to rename column and row labels after using transpose?

packet_hunter — Fri, 02 Dec 2016 22:41:35 GMT

Hi All,
I am having no luck renaming "column" and "row1, row2,..." successfully to "fields" and "event 1, event 2, event3, ...."
I can | rename column as fields, but no luck with the rows.

Please advise how to rename the column to fields and rows to events, row1>event1.

Thank you

Re: How to rename column and row labels after using transpose?

sundareshr — Fri, 02 Dec 2016 22:58:45 GMT

For row values, you have to use replace not rename. Try this replace "column 1" WITH "somevalue" IN column

Re: How to rename column and row labels after using transpose?

packet_hunter — Tue, 06 Dec 2016 16:22:28 GMT

Thank you for the reply. I may have a miscommunication. I actually just want to rename the column and row labels, not necessarily use Splunk fields.

....| transpose | rename column as Details, "row 1" as 1

so I would like to auto-rename the row 1, row 2, row 3, to just be 1, 2, 3 (dropping the word row)
Is that possible?

I guess the answer is YES, just needed

| transpose | rename column as Details, row* as *

Re: How to rename column and row labels after using transpose?

sundareshr — Tue, 06 Dec 2016 18:21:46 GMT

You mean like this?

| transpose | rename column AS Details "row "* AS *

Re: How to rename column and row labels after using transpose?

jbjerke_splunk — Wed, 06 Mar 2019 14:10:04 GMT

The right way to do this is to use the header_field option for the transpose command

| transpose header_field=Key

Re: How to rename column and row labels after using transpose?

astackpole — Fri, 23 Apr 2021 20:49:48 GMT

Hello!

I'm in a similar situation now and this works great but I was wondering if there's a way to individually rename each column? The 'not working' way would look like this:

... | rename row1 AS "Column 1", row2 AS "Scan Logs", row3 AS "etc."

Help on this would be greatly appreciated!

Re: How to rename column and row labels after using transpose?

nmsaraujo — Thu, 16 Jun 2022 13:19:32 GMT

You need to use:

... | rename "row 1" as "This is Column 1", "row 2" as "This is Column 2", etc

Re: How to rename column and row labels after using transpose?

kmarion1993 — Thu, 27 Oct 2022 18:08:40 GMT

One option is to use the foreach command

... | foreach "row "* [ rename "row "<<MATCHSTR>> AS ROW<<MATCHSTR>> ]