Splunk Search
Highlighted

What happened to the transposed dates?

Path Finder

I made a query that involves transposing a timechart (span=1w, analyzing since 1/1/2020).

The result is the exact layout I want, however, several columns representing dates after the transpose are missing (ie. nothing in February showed up).

Is there a limit in splunk how many columns are transposed?

Query:

splunk_server=indexer* index=wsi_tax_summary sourcetype=stash intuit_tid=* intuit_offeringid=* capability=* 
error_msg_service=* http_status_code_host=* 
| timechart span=1w dc(intuit_tid) as total_requests, dc(eval(if(error_msg_service="OK", intuit_tid,null))) as total_success 
| sort -_time 
| eval _time=strftime(_time,"%m/%d/%y") 
| eval total_failures=total_requests-total_success 
| eval success_rate= ROUND((total_success/total_requests)*100,2) 
| transpose header_field=_time column_name=week_starting
| regex week_starting!=("^_")
| eval sortkey=case(week_starting="total_requests",1, week_starting="total_success", 2, week_starting="total_failures", 3, 
week_starting="success_rate", 4)
| sort sortkey
| fields - sortkey

alt text

0 Karma
Highlighted

Re: What happened to the transposed dates?

SplunkTrust
SplunkTrust

The transpose command is limited to 5 rows unless you specify otherwise. RTM at https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Transpose

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: What happened to the transposed dates?

Path Finder

I totally missed that part! Thank you! Fixed 🙂

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.