Splunk Search

Why does the time field show up in the transpose header?

jip31
Motivator

hello

I use a transpose command in a table panel

 

 

| eval time=strftime(_time,"%H:%M") 
| sort time 
| fields - _time _span _origtime 
| transpose 0 header_field=time column_name=KPI include_empty=true

 

 

 But randomly, instead having the time field in the header, I have row1, row2, row3....

jip31_0-1649223867756.png

what is wrong please?

 

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

please try tu use transpose after a grouping command as stats, something like this:

your_search
| bin _time span=1m
| stats values(KPI) AS KPI BY _time
| transpose 0 header_field=_time column_name=KPI include_empty=true

in your search, you have too many fields and too many values all equal because you grouped by minute.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

please try tu use transpose after a grouping command as stats, something like this:

your_search
| bin _time span=1m
| stats values(KPI) AS KPI BY _time
| transpose 0 header_field=_time column_name=KPI include_empty=true

in your search, you have too many fields and too many values all equal because you grouped by minute.

Ciao.

Giuseppe

0 Karma

jip31
Motivator

hi thanks even if i use transpose after a grouping command too;-)

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...