Splunk Search

How to rename column and row labels after using transpose?

Contributor

Hi All,
I am having no luck renaming "column" and "row1, row2,..." successfully to "fields" and "event 1, event 2, event3, ...."
I can | rename column as fields, but no luck with the rows.

Please advise how to rename the column to fields and rows to events, row1>event1.

Thank you

1 Solution

Legend

For row values, you have to use replace not rename. Try this replace "column 1" WITH "somevalue" IN column

View solution in original post

Splunk Employee
Splunk Employee

The right way to do this is to use the header_field option for the transpose command

| transpose header_field=Key

Legend

For row values, you have to use replace not rename. Try this replace "column 1" WITH "somevalue" IN column

View solution in original post

Contributor

Thank you for the reply. I may have a miscommunication. I actually just want to rename the column and row labels, not necessarily use Splunk fields.

....| transpose | rename column as Details, "row 1" as 1

so I would like to auto-rename the row 1, row 2, row 3, to just be 1, 2, 3 (dropping the word row)
Is that possible?

I guess the answer is YES, just needed

| transpose | rename column as Details, row* as *

0 Karma

Legend

You mean like this?

| transpose | rename column AS Details "row "* AS *