Splunk Search

Tranpose Column and Row Headings

IRHM73
Motivator

Hi, I wonder whether someone may be able to help me please.

I'm trying to compare the apps set up in my four environments i.e DEV, QA, Staging and PROD.

So for each environment I have written the following query which I will then extract into Excel to compare:

| rest /services/apps/local | search disabled=0 | table label, title, eai:acl.perms.read, eai:acl.perms.write, version
|rename label as "App Name", title as "App Folder", eai:acl.perms.read as "Read Access", eai:acl:perms.write as "Write Access", version as "Version"
|sort +"App Name"

The query works fine, but I'm trying to transpose the table so, that the values in column "A" become he column headers, and the column headers become the row titles.

I've tried using "transpose", "chart over", and "xy series", but I just can't seem to get this to work.

I just wondered whether someone could possibly look at this please and offer some guidance on how I may achieve this.

Many thanks and kind regards

Chris

0 Karma
1 Solution

javiergn
Super Champion

Hi, have you tried

| transpose header_field="column A"

For instance:

| rest /services/apps/local 
| search disabled=0 
| table label, title, eai:acl.perms.read, eai:acl.perms.write, version
| rename label as "App Name", title as "App Folder", eai:acl.perms.read as "Read Access", eai:acl:perms.write as "Write Access", version as "Version"
| sort +"App Name"
| transpose header_field="App Name"

EDIT (version 2):

| rest /services/apps/local 
| search disabled=0 
| table label, title, eai:acl.perms.read, eai:acl.perms.write, version
| rename label as "App Name", title as "App Folder", eai:acl.perms.read as "Read Access", eai:acl:perms.write as "Write Access", version as "Version"
| sort +"App Name"
| transpose 0 header_field="App Name" include_empty=false

View solution in original post

javiergn
Super Champion

Hi, have you tried

| transpose header_field="column A"

For instance:

| rest /services/apps/local 
| search disabled=0 
| table label, title, eai:acl.perms.read, eai:acl.perms.write, version
| rename label as "App Name", title as "App Folder", eai:acl.perms.read as "Read Access", eai:acl:perms.write as "Write Access", version as "Version"
| sort +"App Name"
| transpose header_field="App Name"

EDIT (version 2):

| rest /services/apps/local 
| search disabled=0 
| table label, title, eai:acl.perms.read, eai:acl.perms.write, version
| rename label as "App Name", title as "App Folder", eai:acl.perms.read as "Read Access", eai:acl:perms.write as "Write Access", version as "Version"
| sort +"App Name"
| transpose 0 header_field="App Name" include_empty=false

woodcock
Esteemed Legend

Neither one of these works for me on v6.2.3.

0 Karma

IRHM73
Motivator

Emm strange, works fine on 6.3.3

Regards

Chris

0 Karma

IRHM73
Motivator

Hi, thank you for coming back to me with this.

Yes I have already tried your suggestion, but the problem I have is that it only creates column headings for the first three values from what would have been the values in column A.

Many thanks and kind regards

Chris

0 Karma

IRHM73
Motivator

HI, thank you for coming back to me with this.

Your "version2" works great.

Kind Regards

Chris

0 Karma

javiergn
Super Champion

What about this?

| rest /services/apps/local 
| search disabled=0 
| table label, title, eai:acl.perms.read, eai:acl.perms.write, version
| rename label as "App Name", title as "App Folder", eai:acl.perms.read as "Read Access", eai:acl:perms.write as "Write Access", version as "Version"
| sort +"App Name"
| transpose 0 header_field="App Name" include_empty=false
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...