Splunk Search

How do I delete header with transpose?

jip31
Motivator

hello

I use a transpose command in order to have _time field displayed in column instead row

First question :

how to delete the header?

jip31_0-1647604765742.png

second question :

 

I was doing a color formatting like this

<format type="color" field="Qualité">
<colorPalette type="list">[#53A051,#F1813F,#DC4E41]</colorPalette>
<scale type="threshold">2,10</scale>
</format>

 

Since use transpose, the formatting doesnt works

what I have to do please?

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Use header_field

transpose - Splunk Documentation

Remove  field="Qualité" so that the formatting applies to all fields

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use header_field

transpose - Splunk Documentation

Remove  field="Qualité" so that the formatting applies to all fields

0 Karma

jip31
Motivator

I done header_field= Menu but I have always row1, row2....

0 Karma

yuanliu
SplunkTrust
SplunkTrust

@jip31 wrote:

I done header_field= Menu but I have always row1, row2....


This only means that "Menu" is not a column name in your original table.  You need to look at column "column", and decide which row should be used as header_field. (Very probably it is the first row .)

Look at the table from this sample search:

index=_internal
| chart count over log_level by sourcetype

Try the following three commands:

  1. | transpose
  2. | transpose header_field=log_level
  3. | transpose header_field=log_level column_name=sourcetype

You'll see how these options interact with the original table.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is your full search?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...