Is it possible to have another column header on top of a column header?

[rajyah]

So basically it'll be like this...

I wanna know if there's a way for Column 2 and Column 3 to have their 'Mother' header.

I'm really sorry if this was already asked, I just don't know the term to be used to search in this website. Please help.. I thank you in advance!

[kamlesh_vaghela]

@rajyah

Have you tried header_field parameter?

http://docs.splunk.com/Documentation/Splunk/7.1.3/SearchReference/Transpose

Thanks

[rajyah]

Thanks for the response sir, it seems that someone already solved their problem without using header_field.

https://answers.splunk.com/answers/646424/transpose-multiple-column-headers.html

I don't get what he did... I'm sorry I'm still new in using splunk.

[rajyah]

And sir, about your header_field. Can you please give me an example which uses _internal index?

[kamlesh_vaghela]

sure.
Please execute below two searches. You can find the purpose of header_field in transpose.

index=_internal | stats count by sourcetype | transpose 


index=_internal | stats count by sourcetype | transpose header_field=sourcetype 

If this answer helps you then accept and upvote it to help community.

[kamlesh_vaghela]

@rajyah
Have you tried above searches?