I made a query that involves transposing a timechart (span=1w, analyzing since 1/1/2020).
The result is the exact layout I want, however, several columns representing dates after the transpose are missing (ie. nothing in February showed up).
Is there a limit in splunk how many columns are transposed?
splunk_server=indexer* index=wsi_tax_summary sourcetype=stash intuit_tid=* intuit_offeringid=* capability=*
| timechart span=1w dc(intuit_tid) as total_requests, dc(eval(if(error_msg_service="OK", intuit_tid,null))) as total_success
| sort -_time
| eval _time=strftime(_time,"%m/%d/%y")
| eval total_failures=total_requests-total_success
| eval success_rate= ROUND((total_success/total_requests)*100,2)
| transpose header_field=_time column_name=week_starting
| regex week_starting!=("^_")
| eval sortkey=case(week_starting="total_requests",1, week_starting="total_success", 2, week_starting="total_failures", 3,
| sort sortkey
| fields - sortkey
The transpose command is limited to 5 rows unless you specify otherwise. RTM at https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Transpose
View solution in original post
I totally missed that part! Thank you! Fixed 🙂