Transpose a (table-like) query result by creating an event (row) for each column (attribute name), in which attributes are named row[1], row[2], etc.

ParameterTypeRequiredDefaultDescription
columnstringfalsecolumnField to use as column value.
headerstringfalse Use this field as header value.
limitnumberfalse5Maximum number of rows to transpose (limited to 1000).
  Maximum1000 
pivotstringfalse Use this field as header AND column value. [a]

[a] If an argument name is not given, pivot is the default argument.

For example, given a query that returns a table, such as 

groupby(loglevel)
loglevel _count
ERROR 2
WARN 400
INFO 200

The result can be transposed to:

logscale
groupby(loglevel)
| transpose()
column row[1] row[2] row[3]
_count 2 400 200
loglevel ERROR WARN INFO

To use the loglevel row as the header, use:

logscale
...
| transpose(header=loglevel)
column ERROR WARN INFO
_count 2 400 200

transpose() Examples

Given a count of different log levels, transpose this into a single row with counts for each log level.

logscale
groupby(loglevel)
| transpose(header=loglevel)
| drop(column)

Make a pivot-like table for two key fields a and b:

logscale
groupby(a, function={groupby(#kind, function=max(c))
| transpose(header=b)
| drop(column)})