Transpose a (table-like) query result by creating an event (row) for each column (attribute name), in which attributes are named row[1], row[2], etc.

For example, given a query that returns a table, such as groupby(loglevel):

loglevel _count
ERROR 2
WARN 400
INFO 200

The result can be transposed to groupby(loglevel) | transpose().

column row[1] row[2] row[3]
_count 2 400 200
loglevel ERROR WARN INFO

To use the loglevel row as the header, use ... | transpose(header=loglevel):

column ERROR WARN INFO
_count 2 400 200

ParameterTypeRequiredDefaultDescription
columnstringfalsecolumnField to use as column value.
headerstringfalse Use this field as header value.
limitnumberfalse5Maximum number of rows to transpose (limited to 1000).
pivotstringfalse Use this field as header AND column value.

Examples

Given a count of different log levels, transpose this into a single row with counts for each log level.

humio
groupby(loglevel) | transpose(header=loglevel) | drop(column)

Make a pivot-like table for two key fields a and b:

humio
groupby(a, function={groupby(#kind, function=max(c)) | transpose(header=b) | drop(column)})