transpose() Query Function

Transpose a (table-like) query result by creating an event (row) for each column (attribute name), in which attributes are named row[1], row[2], etc.

For example, given a query that returns a table, such as groupby(loglevel):

loglevel

_count

ERROR

2

WARN

400

INFO

200

The result can be transposed to groupby(loglevel) | transpose().

column

row[1]

row[2]

row[3]

_count

2

400

200

loglevel

ERROR

WARN

INFO

To use the loglevel row as the header, use ... | transpose(header=loglevel):

column

ERROR

WARN

INFO

_count

2

400

200

Parameters

Name

Type

Required

Default

Description

limit

number

No

5

Maximum number of rows to transpose (limited to 1000).

pivot

string

No

Use this field as header AND column value.

header

string

No

Use this field as header value.

column

string

No

column

Field to use as column value.

The implied parameter is pivot.

Examples

Given a count of different log levels, transpose this into a single row with counts for each log level.

humio
groupby(loglevel) | transpose(header=loglevel) | drop(column)