Feedback:

convert

Use the convert operator to rotate the rows and column values.

Syntax

|convert int=<int> columnname=<string> includeempty={boolean} headerfield=<field>

int=<int>

Number of rows in the original table to use as columns in the new results table.

Default: 5

Max: 50

columnname=<string>

The name of the first column, containing the column names of the table that was converted. Default: 'column'

includeempty={true|false}

Skip columns with empty values. Default: true

headerfield=<field> Specify the field to be used as header.

Usage

You can use the convert operator to rotate a table such that the rows and columns are swapped. Returns the column names as a column, <columnname>, and the rows as columns named row1, row2 , and so on.

Examples

Example 1: Transpose table with default settings.

Copy
|convert

Example 2: Rotate table with six rows as columns.

Copy
|convert int=6

Example 3: Transpose with custom column naming and empty field inclusion.

Copy
|convert int=3 columnname='test' includeempty=true

Example 4: Convert with custom header field from sourcetype.

Copy
|convert int=6 columnname='columns' headerfield=sourcetype

Example 5: Transpose with extended row count as columns.

Copy
|convert int=10