transpose( ) Query Function

Transpose a (table-like) query result by creating an event (row) for each column (attribute name), in which attributes are named row[1], row[2], …

For example, given a query that returns a table, such as groupby(loglevel)

loglevel _count
ERROR 2
WARN 400
INFO 200

The result can be transposed to groupby(loglevel) | transpose().

column row[1] row[2] row[3]
_count 2 400 200
loglevel ERROR WARN INFO

To use the loglevel row as the header, use … | transpose(header=loglevel)

column ERROR WARN INFO
_count 2 400 200

Parameters

Name Type Required Default Description
limit number No 5 Maximum number of rows to transpose (limited to 1000).
pivot string No Use this field as header AND column value.
header string No Use this field as header value.
column string No column Field to use as column value.

pivot is the unnamed parameter.

Examples

Given a count of different log levels, transpose this into a single row with counts for each log level.

groupby(loglevel) | transpose(header=loglevel) | drop(column)