topic Re: help on transpose in Splunk Search

How do I delete header with transpose?

jip31 — Fri, 18 Mar 2022 15:09:33 GMT

hello

I use a transpose command in order to have _time field displayed in column instead row

First question :

how to delete the header?

second question :

I was doing a color formatting like this

Since use transpose, the formatting doesnt works

what I have to do please?

Re: help on transpose

ITWhisperer — Fri, 18 Mar 2022 12:29:30 GMT

Use header_field

transpose - Splunk Documentation

Remove field="Qualité" so that the formatting applies to all fields

Re: help on transpose

jip31 — Fri, 18 Mar 2022 14:27:50 GMT

I done header_field= Menu but I have always row1, row2....

Re: help on transpose

ITWhisperer — Fri, 18 Mar 2022 14:30:06 GMT

What is your full search?

Re: help on transpose

yuanliu — Sat, 19 Mar 2022 18:34:59 GMT

@jip31 wrote:
I done header_field= Menu but I have always row1, row2....

This only means that "Menu" is not a column name in your original table. You need to look at column "column", and decide which row should be used as header_field. (Very probably it is the first row .)

Look at the table from this sample search:

index=_internal | chart count over log_level by sourcetype

Try the following three commands:

| transpose
| transpose header_field=log_level
| transpose header_field=log_level column_name=sourcetype

You'll see how these options interact with the original table.