Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to change table header after using transpo...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi I am using transpose command (transpose 23), to turn 23 rows to column but I am getting table header as row 1, row 2, row 3 ... row 23,
How can I remove this?
Is it possible to make "Name" as table header instead of row 1, row 2 etc..
Search :
... | chart count(Eval(state="Ok")) as Success, count(Eval(state="NotOk")) as Fail by Name | eval Colour=if(Fail>0,"#FF0000", "#00FF00") | transpose 23
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You don't really need to use transpose. Try this instead:
... | chart ... | eval ... | untable key name value | xyseries name key value
Note how key and name trade places, effectively transposing the table without the nasty sideeffect of transpose messing up the column names.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A much simpler ways is to just header_field=Name after your transpose command .
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this should be the correct answer
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
use transpose header_field=
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You don't really need to use transpose. Try this instead:
... | chart ... | eval ... | untable key name value | xyseries name key value
Note how key and name trade places, effectively transposing the table without the nasty sideeffect of transpose messing up the column names.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After transpose you can rename the fields
your search terms.. | transpose 23 | rename "row 1" as Row1, "row 2" as Row2,.........
I am trying for a better approach. I will post it as soon as i find one 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is it possible to make "Name" as table header instead of row 1, row 2 etc..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this one:
index="web_app" | top app_user | transpose column_name="First Column Name" header_field=app_user include_empty=false
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
