How to change table header after using transpose command?

[marellasunil]

Hi I am using transpose command (transpose 23), to turn 23 rows to column but I am getting table header as row 1, row 2, row 3 ... row 23,
How can I remove this?
Is it possible to make "Name" as table header instead of row 1, row 2 etc..

Search :

... | chart count(Eval(state="Ok")) as Success, count(Eval(state="NotOk")) as Fail by Name | eval Colour=if(Fail>0,"#FF0000", "#00FF00") | transpose 23

[AdixitSplunk]

A much simpler ways is to just header_field=Name after your transpose command .

[morethanyell]

this should be the correct answer

[purnavenkatesh]

https://answers.splunk.com/answers/345937/how-to-transpose-a-table-to-make-the-values-in-col.html?so...

use transpose header_field=

[martin_mueller · Accepted solution]

You don't really need to use transpose. Try this instead:

... | chart ... | eval ... | untable key name value | xyseries name key value

Note how key and name trade places, effectively transposing the table without the nasty sideeffect of transpose messing up the column names.

[strive]

After transpose you can rename the fields

your search terms.. | transpose 23 | rename "row 1" as Row1, "row 2" as Row2,.........

I am trying for a better approach. I will post it as soon as i find one 🙂

[marellasunil]

Is it possible to make "Name" as table header instead of row 1, row 2 etc..

[moisesroth]

Try this one:
index="web_app" | top app_user | transpose column_name="First Column Name" header_field=app_user include_empty=false