help on transpose command

[jip31]

hello

In the search below, I need to display anything if the Hostname is not found

Actually, I have the fields displayed even if the hostname doesnt exists (see attachment here https://www.cjoint.com/c/KCmgUBEZndg)

How to display anything if the hostname doesnt exists please??

`wire` 
| fields AP_NAME USERNAME LAST_SEEN 
| lookup ap.csv NAME as AP_NAME OUTPUT Building Country Site  
| rename USERNAME as host 
| eval time = strftime(_time, "%d-%m-%y %H:%M") 
| stats latest(time) as "Last check date", last(AP_NAME) as "Access Point", last(Site) as "Geolocation site", last(Building) as "Geolocation building" by host 
| rename host as Hostname
| search Hostname=X3020131
| transpose 0 column_name="Geolocation items" header_field=header 
| rename "row 1" as "Geolocation results"

[scelikok · Accepted solution]

Hi @jip31,

You can set include_empty parameter of transpose command to false;

`wire` 
| fields AP_NAME USERNAME LAST_SEEN 
| lookup ap.csv NAME as AP_NAME OUTPUT Building Country Site  
| rename USERNAME as host 
| eval time = strftime(_time, "%d-%m-%y %H:%M") 
| stats latest(time) as "Last check date", last(AP_NAME) as "Access Point", last(Site) as "Geolocation site", last(Building) as "Geolocation building" by host 
| rename host as Hostname
| search Hostname=X3020131
| transpose 0 column_name="Geolocation items" header_field=header include_empty=false
| rename "row 1" as "Geolocation results"

[jip31]

thanks it works