How to display header on transpose command?

[jip31]

Hello

As you can see in my search I transpose time in my header field

| eval time=strftime(_time,"%H:%M") 
| sort time 
| fields - _time _span _origtime _events 
| fillnull value=0 
| transpose 0 header_field=time column_name=KPI include_empty=true 
| sort KPI

Most of the time it works well

But it seems that until I have results = 0, the time header field is dont display

I have row1, instead 08:00, row2 instead 09:00

You can see the result below

is anybody have an idea please?

[ITWhisperer]

Can you show an example of the table before the transpose command?

[jip31]

hi

here is

[ITWhisperer]

Your  _time field is empty. Why is that?

[jip31]

I have just forgotten to delete this pièce of code for my exemple sorry

| eval time=strftime(_time,"%H:%M") 
| sort time 

This code is just used for filling my header_field (header_field=time)

[ITWhisperer]

OK so now what does the table look like before the transpose?

[jip31]

here is

as you can see, fillnull works only when there is a result > 0 

[ITWhisperer]

What was the search which produced this table?

[jip31]

Here is

https://www.cjoint.com/c/LDzpRnxcFYj

[ITWhisperer]

I can't see why the fillnull should not have worked - I have tried recreating the results but have been unable to make it fail. Which version of Splunk are you using?

[jip31]

So its not due to version?

[ITWhisperer]

Possibly not - I haven't tried 8.2.5 but I can't reproduce the problem with 8.2.2 or 8.2.6

[jip31]

Version 8.2.5

As you can see I have the row name in the header field instead time

And most of the time it works normally.....

[ITWhisperer · Accepted solution]

I think the problem comes from the _time field being empty. However, I can't see from your search why this would be the case. Nor can I see why the fillnull doesn't work, especially as you have shown some empty fields.

[jip31]

I think I found

I displayed 0 after header_field=time and it has worked immediately...

| transpose header_field=time 0 column_name=KPI include_empty=true