Splunk Search

How to get Field values as column names/headers in the table output

poddura
Observer

Hi Team,

I have a simple requirement but unable to get it. I am using a query

index=tms sourcetype=kafka type=ssh| stats count by NETYPE

For above query I am getting output as below

NETYPECount
CISCO100
JUNIPER200

 

However, I want output as

CISCOJUNIPER
100200

 

Can you please help how can I get above o/p table

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=NETYPE
| fields - column
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...