My actual query as all this data.
but after i use transpose
| sort by _time desc
| eval mytime=strftime(_time, "%B %d %Y")
| fields - _* | transpose header_field=mytime
I only see the result for first 5 columns
How can i make transpose work for all more than 5days of data
Also is there a way to generically format the color. Because the date changes.
Try this
| transpose 0 header_field=mytime
Thanks @ITWhisperer you are the best!!
is there a way to generically format the color as the date changes everyday/