Splunk Search

How to change table header after using transpose command?

marellasunil
Communicator

Hi I am using transpose command (transpose 23), to turn 23 rows to column but I am getting table header as row 1, row 2, row 3 ... row 23,
How can I remove this?
Is it possible to make "Name" as table header instead of row 1, row 2 etc..

Search :

... | chart count(Eval(state="Ok")) as Success, count(Eval(state="NotOk")) as Fail by Name | eval Colour=if(Fail>0,"#FF0000", "#00FF00") | transpose 23

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You don't really need to use transpose. Try this instead:

... | chart ... | eval ... | untable key name value | xyseries name key value

Note how key and name trade places, effectively transposing the table without the nasty sideeffect of transpose messing up the column names.

View solution in original post

AdixitSplunk
Path Finder

A much simpler ways is to just header_field=Name after your transpose command .

morethanyell
Contributor

this should be the correct answer

0 Karma

purnavenkatesh
Explorer

martin_mueller
SplunkTrust
SplunkTrust

You don't really need to use transpose. Try this instead:

... | chart ... | eval ... | untable key name value | xyseries name key value

Note how key and name trade places, effectively transposing the table without the nasty sideeffect of transpose messing up the column names.

View solution in original post

strive
Influencer

After transpose you can rename the fields

your search terms.. | transpose 23 | rename "row 1" as Row1, "row 2" as Row2,.........

I am trying for a better approach. I will post it as soon as i find one 🙂

marellasunil
Communicator

Is it possible to make "Name" as table header instead of row 1, row 2 etc..

0 Karma

moisesroth
Path Finder

Try this one:
index="web_app" | top app_user | transpose column_name="First Column Name" header_field=app_user include_empty=false

0 Karma