Change Row Values to Column Headings

[IRHM73]

Hi, I wonder whether someone may be able to help me please.

I'm using the query below which extracts a column of fields associated with the index and auditSource:

(index=main) OR (index=dg_<indexname>) auditSource=<fieldvalue>
| fieldsummary 
| where like(field, "detail.%")
| fields field
| rename field as data

I'm trying to change this so the row values become the 'column' headers.

I've tried using the 'transpose' command (below and also the 'chart over', but I can get neither to work

(index=main) OR (index=dg_tax-credits-submissions) auditSource=tax-credits-submissions
| fieldsummary 
| where like(field, "detail.%")
| fields field
| rename field as data
| transpose 0 header_field=data

I just wondered whether someone may be able to look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

[rjthibod · Accepted solution]

The transpose command needs another column in the data in order to handle what you are trying to do. You were correct in how to use the command, but the data preparation needs a bit more. This will add a count column that ends up being the only row after transpose. After that, you can remove that or change its contents depending on your use case.

 (index=main) OR (index=dg_tax-credits-submissions) auditSource=tax-credits-submissions
| fieldsummary 
| where like(field, "detail.%")
| fields field
| rename field as data
| chart count by data
| transpose 0 header_field=data

[IRHM73]

Hi @rjthibod, many thanks for coming back to me with this.

I made a slight adjustment and added a| fields - column at the end of the query.

Regards

Chris