Hi I am using transpose command (transpose 23), to turn 23 rows to column but I am getting table header as row 1, row 2, row 3 ... row 23,
How can I remove this?
Is it possible to make "Name" as table header instead of row 1, row 2 etc..
Search :
... | chart count(Eval(state="Ok")) as Success, count(Eval(state="NotOk")) as Fail by Name | eval Colour=if(Fail>0,"#FF0000", "#00FF00") | transpose 23
You don't really need to use transpose
. Try this instead:
... | chart ... | eval ... | untable key name value | xyseries name key value
Note how key
and name
trade places, effectively transposing the table without the nasty sideeffect of transpose
messing up the column names.
A much simpler ways is to just header_field=Name after your transpose command .
this should be the correct answer
use transpose header_field=
You don't really need to use transpose
. Try this instead:
... | chart ... | eval ... | untable key name value | xyseries name key value
Note how key
and name
trade places, effectively transposing the table without the nasty sideeffect of transpose
messing up the column names.
After transpose you can rename the fields
your search terms.. | transpose 23 | rename "row 1" as Row1, "row 2" as Row2,.........
I am trying for a better approach. I will post it as soon as i find one 🙂
Is it possible to make "Name" as table header instead of row 1, row 2 etc..
Try this one:
index="web_app" | top app_user | transpose column_name="First Column Name" header_field=app_user include_empty=false