<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to transpose a table to make the values in Column 1 the header labels? in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244294#M72732</link>
    <description>&lt;P&gt;Try this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;yoursearch
| transpose header_field=a
| fields - column
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Thu, 21 Jan 2016 10:12:13 GMT</pubDate>
    <dc:creator>javiergn</dc:creator>
    <dc:date>2016-01-21T10:12:13Z</dc:date>
    <item>
      <title>How to transpose a table to make the values in Column 1 the header labels?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244293#M72731</link>
      <description>&lt;P&gt;orange table:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;    a      b
    --------
    fld1   1
    fld2   2
    fld3   3
    fld4   4
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I want to change it to:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;    fld1     fld2     fld3     fld4
    --------------------------------
    1        2        3        4
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Where 'fldx' are the header labels&lt;/P&gt;

&lt;P&gt;However, using the &lt;CODE&gt;transpose&lt;/CODE&gt; command results in:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;    row1    row2    row3    row4
  ----------------------------------
    fld1     fld2     fld3     fld4
    1        2        3        4
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;How do I get the desired result?&lt;/P&gt;</description>
      <pubDate>Thu, 21 Jan 2016 10:01:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244293#M72731</guid>
      <dc:creator>crazyeva</dc:creator>
      <dc:date>2016-01-21T10:01:28Z</dc:date>
    </item>
    <item>
      <title>Re: How to transpose a table to make the values in Column 1 the header labels?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244294#M72732</link>
      <description>&lt;P&gt;Try this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;yoursearch
| transpose header_field=a
| fields - column
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 21 Jan 2016 10:12:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244294#M72732</guid>
      <dc:creator>javiergn</dc:creator>
      <dc:date>2016-01-21T10:12:13Z</dc:date>
    </item>
    <item>
      <title>Re: How to transpose a table to make the values in Column 1 the header labels?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244295#M72733</link>
      <description>&lt;P&gt;awesome cool !&lt;BR /&gt;
thank you very much !&lt;BR /&gt;
I did not find 'header_field' argument in Search Reference v6.2.3. I need update it.&lt;BR /&gt;
by the way I find a solution using &lt;CODE&gt;xyseries&lt;/CODE&gt; command. but it's not so convenient as yours&lt;BR /&gt;
Edit:&lt;BR /&gt;
&lt;CODE&gt;transpose&lt;/CODE&gt;'s width up to only 1000&lt;BR /&gt;
&lt;CODE&gt;xyseries&lt;/CODE&gt; seams will breake the limitation&lt;BR /&gt;
&lt;CODE&gt;|eval tmp="anything"|xyseries tmp a b|fields - tmp&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 21 Jan 2016 10:25:57 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244295#M72733</guid>
      <dc:creator>crazyeva</dc:creator>
      <dc:date>2016-01-21T10:25:57Z</dc:date>
    </item>
    <item>
      <title>Re: How to transpose a table to make the values in Column 1 the header labels?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244296#M72734</link>
      <description>&lt;P&gt;Good job! Actually also in my case  "xysersies" works better!&lt;/P&gt;</description>
      <pubDate>Tue, 15 Mar 2016 14:01:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244296#M72734</guid>
      <dc:creator>marcoscala</dc:creator>
      <dc:date>2016-03-15T14:01:41Z</dc:date>
    </item>
    <item>
      <title>Re: How to transpose a table to make the values in Column 1 the header labels?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244297#M72735</link>
      <description>&lt;P&gt;Hi, &lt;BR /&gt;
Thank You Very much. "transpose header_field=a" worked. &lt;/P&gt;</description>
      <pubDate>Thu, 13 Oct 2016 06:23:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244297#M72735</guid>
      <dc:creator>purnavenkatesh</dc:creator>
      <dc:date>2016-10-13T06:23:11Z</dc:date>
    </item>
    <item>
      <title>Re: How to transpose a table to make the values in Column 1 the header labels?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244298#M72736</link>
      <description>&lt;P&gt;Hi,&lt;BR /&gt;
transpose header_field=count doesn't work for me. Please help&lt;/P&gt;</description>
      <pubDate>Mon, 25 Jun 2018 19:03:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244298#M72736</guid>
      <dc:creator>snayani</dc:creator>
      <dc:date>2018-06-25T19:03:38Z</dc:date>
    </item>
    <item>
      <title>Re: How to transpose a table to make the values in Column 1 the header labels?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244299#M72737</link>
      <description>&lt;P&gt;Hi, can you post here your search and give us more details about your data?&lt;/P&gt;</description>
      <pubDate>Tue, 26 Jun 2018 07:18:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244299#M72737</guid>
      <dc:creator>javiergn</dc:creator>
      <dc:date>2018-06-26T07:18:25Z</dc:date>
    </item>
    <item>
      <title>Re: How to transpose a table to make the values in Column 1 the header labels?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244300#M72738</link>
      <description>&lt;P&gt;Hi, I tried this way and it worked: &lt;BR /&gt;
search string ...... | transpose 5 &lt;BR /&gt;
| rename column as "Database Error Type", "row 1" as "Count"&lt;/P&gt;</description>
      <pubDate>Tue, 26 Jun 2018 12:15:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244300#M72738</guid>
      <dc:creator>snayani</dc:creator>
      <dc:date>2018-06-26T12:15:27Z</dc:date>
    </item>
    <item>
      <title>Re: How to transpose a table to make the values in Column 1 the header labels?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244301#M72739</link>
      <description>&lt;P&gt;OK I have been looking for an answer like this for days!!! Thank you!   &lt;/P&gt;</description>
      <pubDate>Fri, 10 Aug 2018 19:36:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-to-make-the-values-in-Column-1-the/m-p/244301#M72739</guid>
      <dc:creator>jimwilsonssf</dc:creator>
      <dc:date>2018-08-10T19:36:02Z</dc:date>
    </item>
  </channel>
</rss>

