Transpose a (table-like) query result by creating an event (row) for each column (attribute name), in which attributes are named row[1], row[2], etc.

ParameterTypeRequiredDefaultDescription
columnstringfalsecolumnField to use as column value.
headerstringfalse Use this field as header value.
limitnumberfalse5Maximum number of rows to transpose (limited to 1000).
  Maximum1000 
pivotstringfalse Use this field as header AND column value. [a]

[a] When you provide only one parameter, the implied parameter is pivot

For example, given a query that returns a table, such as

groupby(loglevel)
loglevel _count
ERROR 2
WARN 400
INFO 200

The result can be transposed to:

logscale
groupby(loglevel) | transpose()
column row[1] row[2] row[3]
_count 2 400 200
loglevel ERROR WARN INFO

To use the loglevel row as the header, use:

logscale
...
| transpose(header=loglevel)
column ERROR WARN INFO
_count 2 400 200

Examples

Given a count of different log levels, transpose this into a single row with counts for each log level.

logscale
groupby(loglevel) | transpose(header=loglevel) | drop(column)

Make a pivot-like table for two key fields a and b:

logscale
groupby(a, function={groupby(#kind, function=max(c)) | transpose(header=b) | drop(column)})