So basically it'll be like this...
I wanna know if there's a way for Column 2 and Column 3 to have their 'Mother' header.
I'm really sorry if this was already asked, I just don't know the term to be used to search in this website. Please help.. I thank you in advance!
@rajyah
Have you tried header_field
parameter?
http://docs.splunk.com/Documentation/Splunk/7.1.3/SearchReference/Transpose
Thanks
Thanks for the response sir, it seems that someone already solved their problem without using header_field.
https://answers.splunk.com/answers/646424/transpose-multiple-column-headers.html
I don't get what he did... I'm sorry I'm still new in using splunk.
And sir, about your header_field. Can you please give me an example which uses _internal index?
sure.
Please execute below two searches. You can find the purpose of header_field in transpose.
index=_internal | stats count by sourcetype | transpose
index=_internal | stats count by sourcetype | transpose header_field=sourcetype
If this answer helps you then accept and upvote it to help community.
@rajyah
Have you tried above searches?