transpose
Description
Returns the specified number of rows (search results) as columns (a list of field values), so that each search row becomes a column.
Syntax
transpose [<count>] [column_name=<string>] [header_field=<string>] [include_empty=<bool>]
Optional Arguments
| Parameter | Syntax | Default | Description |
|---|---|---|---|
count | <int> | 5 | The number of rows to transpose. If 0, all rows will be transposed. |
column_name | column_name=<string> | column | The name of the first column to use for transposed rows. This column contains field names. |
header_field | header_field=<string> | row 1, row 2, row 3, and so on | The name of the field in your results that will be used for column names (except the first column) in the transposed data. |
include_empty | include_empty=<bool> | true | If true, includes fields with empty values. |
Query Examples
Example 1
In this example, the first five rows become columns.
... | transpose
Example 2
In this example, the first two rows become columns.
... | transpose 2
Example 3
In this example, the first five rows become columns, and the first column is named new_column.
... | transpose column_name="new_column"
Example 4
In this example, the first three rows become columns, and the column names following the first are: new_row1, new_row2, new_row3.
... | transpose 3 header_field="new_row"