convert
Use the convert operator to rotate the rows and column values.
Syntax
|convert int=<int> columnname=<string> includeempty={boolean} headerfield=<field>
int=<int>
|
Number of rows in the original table to use as columns in the new results table. Default: Max: 50 |
columnname=<string>
|
The name of the first column, containing the column names of the table that was converted. Default: |
includeempty={true|false}
|
Skip columns with empty values. Default: |
headerfield=<field>
|
Specify the field to be used as header. |
Usage
You can use the convert operator to rotate a table such that the rows and columns are swapped. Returns the column names as a column, <columnname>, and the rows as columns named row1, row2 , and so on.
Examples
Example 1: Transpose table with default settings.
|convert
Example 2: Rotate table with six rows as columns.
|convert int=6
Example 3: Transpose with custom column naming and empty field inclusion.
|convert int=3 columnname='test' includeempty=true
Example 4: Convert with custom header field from sourcetype.
|convert int=6 columnname='columns' headerfield=sourcetype
Example 5: Transpose with extended row count as columns.
|convert int=10