Getting Data In

How to remove row1 row 2 after using transpose command .

Path Finder

I have just used .....chart count by env |addcolstotals |fillnull value="Total" env In my query
Its actually giving result as:

env Count
POD1 5
POD2 2
POD3 3
Total 10
I want it to be like
POD1 POD2 POD3 Total
5 2 3 10
I used transpose command but its giving result like:
column row1 row2 row 3
env POD1 POD2 POD3
Count 5 2 3

Is it possible to make "POD1" POD2 as table header instead of row 1, row 2 etc.
Please help me with this .

0 Karma
1 Solution

Legend

hi AdixitSplunk,
use header_field=env in your transpose command.
see https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Transpose
Bye.
Giuseppe

View solution in original post

Legend

hi AdixitSplunk,
use header_field=env in your transpose command.
see https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Transpose
Bye.
Giuseppe

View solution in original post

Influencer

Jeez you're making this too easy 🙂

0 Karma

Path Finder

Fantastic 🙂

0 Karma

Influencer

Does this give you what you're after?

...stats count by env |eventstats sum(count) as total |fillnull value="Total" env | chart limit=0 values(count) over total by host
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!