topic Re: help on transpose command in Splunk Search

How to display header on transpose command?

jip31 — Mon, 25 Apr 2022 15:04:10 GMT

Hello

As you can see in my search I transpose time in my header field

Most of the time it works well

But it seems that until I have results = 0, the time header field is dont display

I have row1, instead 08:00, row2 instead 09:00

You can see the result below

is anybody have an idea please?

Re: help on transpose command

ITWhisperer — Sun, 24 Apr 2022 07:21:55 GMT

Can you show an example of the table before the transpose command?

Re: help on transpose command

jip31 — Sun, 24 Apr 2022 08:00:46 GMT

here is

Re: help on transpose command

ITWhisperer — Sun, 24 Apr 2022 08:03:32 GMT

Your _time field is empty. Why is that?

Re: help on transpose command

jip31 — Sun, 24 Apr 2022 08:46:55 GMT

I have just forgotten to delete this pièce of code for my exemple sorry

| eval time=strftime(_time,"%H:%M") 
| sort time

This code is just used for filling my header_field (header_field=time)

Re: help on transpose command

ITWhisperer — Sun, 24 Apr 2022 08:50:14 GMT

OK so now what does the table look like before the transpose?

Re: help on transpose command

jip31 — Mon, 25 Apr 2022 05:38:13 GMT

here is

as you can see, fillnull works only when there is a result > 0

Re: help on transpose command

ITWhisperer — Mon, 25 Apr 2022 06:27:27 GMT

What was the search which produced this table?

Re: help on transpose command

jip31 — Mon, 25 Apr 2022 15:45:06 GMT

Here is

https://www.cjoint.com/c/LDzpRnxcFYj

Re: help on transpose command

ITWhisperer — Mon, 25 Apr 2022 17:43:42 GMT

I can't see why the fillnull should not have worked - I have tried recreating the results but have been unable to make it fail. Which version of Splunk are you using?

Re: help on transpose command

jip31 — Tue, 26 Apr 2022 06:06:05 GMT

Version 8.2.5

As you can see I have the row name in the header field instead time

And most of the time it works normally.....

Re: help on transpose command

jip31 — Wed, 27 Apr 2022 05:02:06 GMT

So its not due to version?

Re: help on transpose command

ITWhisperer — Wed, 27 Apr 2022 07:17:17 GMT

Possibly not - I haven't tried 8.2.5 but I can't reproduce the problem with 8.2.2 or 8.2.6

Re: help on transpose command

ITWhisperer — Wed, 27 Apr 2022 07:19:53 GMT

I think the problem comes from the _time field being empty. However, I can't see from your search why this would be the case. Nor can I see why the fillnull doesn't work, especially as you have shown some empty fields.

Re: help on transpose command

jip31 — Wed, 27 Apr 2022 10:47:46 GMT

I think I found

I displayed 0 after header_field=time and it has worked immediately...

| transpose header_field=time 0 column_name=KPI include_empty=true