Getting Data In

Is it possible to remove the header in after transposing

Sampathu
Explorer

I am using the untable command instead of transpose and my result looks like

Metrics Value
cpu_core 4
ram_size 8

Can i use any command so that i don't get the header itself. My result must look like(after removing header Metrics and Value)

cpu_core 4
ram_size 8

Tags (3)
0 Karma

jkat54
SplunkTrust
SplunkTrust

... | rename Metrics as " " Value as " "

Try that, or do space dot space, etc. I'm putting more than one space between the second quotes but the forum is changing to one space

0 Karma

sundareshr
Legend

Do these two columns have names? You could try | search col2!="Value"

Out of curiosity, why are you using untable or transpose command? You should be able to get the desired result with just the table command like this table Metric Value

0 Karma

Sampathu
Explorer

No. In my actual search the result is

cpu_core ram_size
4 8

query = original search......... | untable _time Metrics Value... (I know how to remove the _time field )
when I untable them i get it as

Metrics Value
cpu_core 4
ram_size 8

Am curious to know whether we can remove the headers itself!!

0 Karma

somesoni2
Revered Legend

What visualization you're try to use? If you're using table, then a table need it's header/column name. You can try html visualization in you can you need custom visualization.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...