How to rename column and row labels after using transpose?

[packet_hunter]

Hi All,
I am having no luck renaming "column" and "row1, row2,..." successfully to "fields" and "event 1, event 2, event3, ...."
I can | rename column as fields, but no luck with the rows.

Please advise how to rename the column to fields and rows to events, row1>event1.

Thank you

[jbjerke_splunk]

The right way to do this is to use the header_field option for the transpose command

| transpose header_field=Key

[sundareshr · Accepted solution]

For row values, you have to use replace not rename. Try this replace "column 1" WITH "somevalue" IN column

[kmarion1993]

One option is to use the foreach command

... | foreach "row "* [ rename "row "<<MATCHSTR>> AS ROW<<MATCHSTR>> ]

[packet_hunter]

Thank you for the reply. I may have a miscommunication. I actually just want to rename the column and row labels, not necessarily use Splunk fields.

....| transpose | rename column as Details, "row 1" as 1

so I would like to auto-rename the row 1, row 2, row 3, to just be 1, 2, 3 (dropping the word row)
Is that possible?

I guess the answer is YES, just needed

| transpose | rename column as Details, row* as *

[sundareshr]

You mean like this?

| transpose | rename column AS Details "row "* AS *

[astackpole]

Hello!

I'm in a similar situation now and this works great but I was wondering if there's a way to individually rename each column?  The 'not working' way would look like this:

... | rename row1 AS "Column 1", row2 AS "Scan Logs", row3 AS "etc."

Help on this would be greatly appreciated!

[nmsaraujo]

You need to use:

... | rename "row 1" as "This is Column 1",  "row 2" as  "This is Column 2", etc