Splunk Search

How to transpose a table to make the values in Column 1 the header labels?

crazyeva
Contributor

orange table:

    a      b
    --------
    fld1   1
    fld2   2
    fld3   3
    fld4   4

I want to change it to:

    fld1     fld2     fld3     fld4
    --------------------------------
    1        2        3        4

Where 'fldx' are the header labels

However, using the transpose command results in:

    row1    row2    row3    row4
  ----------------------------------
    fld1     fld2     fld3     fld4
    1        2        3        4

How do I get the desired result?

1 Solution

javiergn
Super Champion

Try this:

yoursearch
| transpose header_field=a
| fields - column

View solution in original post

javiergn
Super Champion

Try this:

yoursearch
| transpose header_field=a
| fields - column

purnavenkatesh
Explorer

Hi,
Thank You Very much. "transpose header_field=a" worked.

0 Karma

snayani
Explorer

Hi,
transpose header_field=count doesn't work for me. Please help

0 Karma

javiergn
Super Champion

Hi, can you post here your search and give us more details about your data?

0 Karma

snayani
Explorer

Hi, I tried this way and it worked:
search string ...... | transpose 5
| rename column as "Database Error Type", "row 1" as "Count"

crazyeva
Contributor

awesome cool !
thank you very much !
I did not find 'header_field' argument in Search Reference v6.2.3. I need update it.
by the way I find a solution using xyseries command. but it's not so convenient as yours
Edit:
transpose's width up to only 1000
xyseries seams will breake the limitation
|eval tmp="anything"|xyseries tmp a b|fields - tmp

jimwilsonssf
Engager

OK I have been looking for an answer like this for days!!! Thank you!

marcoscala
Builder

Good job! Actually also in my case "xysersies" works better!

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...