Getting Data In

How to remove row1 row 2 after using transpose command .

AdixitSplunk
Path Finder

I have just used .....chart count by env |addcolstotals |fillnull value="Total" env In my query
Its actually giving result as:

env Count
POD1 5
POD2 2
POD3 3
Total 10
I want it to be like
POD1 POD2 POD3 Total
5 2 3 10
I used transpose command but its giving result like:
column row1 row2 row 3
env POD1 POD2 POD3
Count 5 2 3

Is it possible to make "POD1" POD2 as table header instead of row 1, row 2 etc.
Please help me with this .

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

hi AdixitSplunk,
use header_field=env in your transpose command.
see https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Transpose
Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

hi AdixitSplunk,
use header_field=env in your transpose command.
see https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Transpose
Bye.
Giuseppe

jplumsdaine22
Influencer

Jeez you're making this too easy 🙂

0 Karma

AdixitSplunk
Path Finder

Fantastic 🙂

0 Karma

jplumsdaine22
Influencer

Does this give you what you're after?

...stats count by env |eventstats sum(count) as total |fillnull value="Total" env | chart limit=0 values(count) over total by host
0 Karma
Get Updates on the Splunk Community!

Extending Splunk AI Assistant for SPL to Splunk Enterprise customers!

Howdy Splunk Community! It’s an exciting day here at Splunk – Splunk AI Assistant for SPL version 1.3.0 is now ...

Developer Spotlight with Qmulos

Qmulos: Building a Next-Level Cybersecurity Business through Splunk Apps Qmulos started as a scrappy startup ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...