topic Re: How to change table header after using transpose command? in Splunk Search

How to change table header after using transpose command?

marellasunil — Mon, 11 Aug 2014 09:46:35 GMT

Hi I am using transpose command (transpose 23), to turn 23 rows to column but I am getting table header as row 1, row 2, row 3 ... row 23,
How can I remove this?
Is it possible to make "Name" as table header instead of row 1, row 2 etc..

Search :

... | chart count(Eval(state="Ok")) as Success, count(Eval(state="NotOk")) as Fail by Name | eval Colour=if(Fail>0,"#FF0000", "#00FF00") | transpose 23

Re: How to change table header after using transpose command?

strive — Mon, 11 Aug 2014 10:31:48 GMT

After transpose you can rename the fields

your search terms.. | transpose 23 | rename "row 1" as Row1, "row 2" as Row2,.........

I am trying for a better approach. I will post it as soon as i find one 🙂

Re: How to change table header after using transpose command?

marellasunil — Mon, 11 Aug 2014 11:18:51 GMT

Is it possible to make "Name" as table header instead of row 1, row 2 etc..

Re: How to change table header after using transpose command?

martin_mueller — Mon, 11 Aug 2014 13:43:50 GMT

You don't really need to use transpose. Try this instead:

... | chart ... | eval ... | untable key name value | xyseries name key value

Note how key and name trade places, effectively transposing the table without the nasty sideeffect of transpose messing up the column names.

Re: How to change table header after using transpose command?

purnavenkatesh — Thu, 13 Oct 2016 06:27:10 GMT

https://answers.splunk.com/answers/345937/how-to-transpose-a-table-to-make-the-values-in-col.html?sort=newest

use transpose header_field=

Re: How to change table header after using transpose command?

AdixitSplunk — Thu, 05 Jan 2017 08:05:33 GMT

A much simpler ways is to just header_field=Name after your transpose command .

Re: How to change table header after using transpose command?

moisesroth — Tue, 29 Sep 2020 14:01:32 GMT

Try this one:
index="web_app" | top app_user | transpose column_name="First Column Name" header_field=app_user include_empty=false

Re: How to change table header after using transpose command?

morethanyell — Thu, 08 Nov 2018 04:24:37 GMT

this should be the correct answer