hello
I use a transpose command in a table panel
| eval time=strftime(_time,"%H:%M")
| sort time
| fields - _time _span _origtime
| transpose 0 header_field=time column_name=KPI include_empty=true
But randomly, instead having the time field in the header, I have row1, row2, row3....
what is wrong please?
Hi @jip31,
please try tu use transpose after a grouping command as stats, something like this:
your_search
| bin _time span=1m
| stats values(KPI) AS KPI BY _time
| transpose 0 header_field=_time column_name=KPI include_empty=true
in your search, you have too many fields and too many values all equal because you grouped by minute.
Ciao.
Giuseppe
Hi @jip31,
please try tu use transpose after a grouping command as stats, something like this:
your_search
| bin _time span=1m
| stats values(KPI) AS KPI BY _time
| transpose 0 header_field=_time column_name=KPI include_empty=true
in your search, you have too many fields and too many values all equal because you grouped by minute.
Ciao.
Giuseppe
hi thanks even if i use transpose after a grouping command too;-)
Hi @jip31,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉