Splunk Search

How to transpose a table to make the values in Column 1 the header labels?

crazyeva
Contributor

orange table:

    a      b
    --------
    fld1   1
    fld2   2
    fld3   3
    fld4   4

I want to change it to:

    fld1     fld2     fld3     fld4
    --------------------------------
    1        2        3        4

Where 'fldx' are the header labels

However, using the transpose command results in:

    row1    row2    row3    row4
  ----------------------------------
    fld1     fld2     fld3     fld4
    1        2        3        4

How do I get the desired result?

1 Solution

javiergn
Super Champion

Try this:

yoursearch
| transpose header_field=a
| fields - column

View solution in original post

javiergn
Super Champion

Try this:

yoursearch
| transpose header_field=a
| fields - column

purnavenkatesh
Explorer

Hi,
Thank You Very much. "transpose header_field=a" worked.

0 Karma

snayani
Explorer

Hi,
transpose header_field=count doesn't work for me. Please help

0 Karma

javiergn
Super Champion

Hi, can you post here your search and give us more details about your data?

0 Karma

snayani
Explorer

Hi, I tried this way and it worked:
search string ...... | transpose 5
| rename column as "Database Error Type", "row 1" as "Count"

crazyeva
Contributor

awesome cool !
thank you very much !
I did not find 'header_field' argument in Search Reference v6.2.3. I need update it.
by the way I find a solution using xyseries command. but it's not so convenient as yours
Edit:
transpose's width up to only 1000
xyseries seams will breake the limitation
|eval tmp="anything"|xyseries tmp a b|fields - tmp

jimwilsonssf
Engager

OK I have been looking for an answer like this for days!!! Thank you!

marcoscala
Builder

Good job! Actually also in my case "xysersies" works better!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...