https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-rename-a-file-after-extraction/m-p/322754#M6755 <P>1) When posting code on the forum, please be sure to mark it as code, so that things in &lt; &gt; are not deleted by the interface. I've updated your question to mark the code, but there apparently were no items marked to be extracted in the rex. </P> <P>2) The first part of your search says to check records with sourcetype=kaa, and look for events with the word <CODE>temperature</CODE> in them. Best practices are to always specify the index name for a search. </P> <P>3) Renaming _time as Time doesn't accomplish anything except losing the auto-formatting on the field, so it's probably not the reason you are not getting results. Try this, to see if there are any records there to be extracted at all...</P> <PRE><CODE>temperature sourcetype=kaa | head 1 </CODE></PRE> <P>If there are no records, then add the correct index and fix the criteria as needecd. If there is one, then check to see if it has fields <CODE>_time</CODE>, <CODE>_raw</CODE>, and <CODE>mydata</CODE>.</P> <P>If <CODE>mydata</CODE> is not there, then that is your reason for no return records. Correct the <CODE>input=</CODE> parameter on the <CODE>spath</CODE> command to be the correct field name.</P> Wed, 31 May 2017 04:30:00 GMT DalJeanis 2017-05-31T04:30:00Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-rename-a-file-after-extraction/m-p/322753#M6754 <P>Hi, how do I rename _time AS Time in m example below? I'm getting no results with the example below.</P> <PRE><CODE>temperature sourcetype=kaa | rex field=_raw "\"endpointKeyHash\":\{\"string\":\"(?[^\"]*)\".*\"Event\": (?\{.*\})\}$"| spath input=mydata | rename _time AS Time| table Time, endpoint, temperature </CODE></PRE> Wed, 31 May 2017 03:49:14 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-rename-a-file-after-extraction/m-p/322753#M6754 wuming79 2017-05-31T03:49:14Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-rename-a-file-after-extraction/m-p/322754#M6755 <P>1) When posting code on the forum, please be sure to mark it as code, so that things in &lt; &gt; are not deleted by the interface. I've updated your question to mark the code, but there apparently were no items marked to be extracted in the rex. </P> <P>2) The first part of your search says to check records with sourcetype=kaa, and look for events with the word <CODE>temperature</CODE> in them. Best practices are to always specify the index name for a search. </P> <P>3) Renaming _time as Time doesn't accomplish anything except losing the auto-formatting on the field, so it's probably not the reason you are not getting results. Try this, to see if there are any records there to be extracted at all...</P> <PRE><CODE>temperature sourcetype=kaa | head 1 </CODE></PRE> <P>If there are no records, then add the correct index and fix the criteria as needecd. If there is one, then check to see if it has fields <CODE>_time</CODE>, <CODE>_raw</CODE>, and <CODE>mydata</CODE>.</P> <P>If <CODE>mydata</CODE> is not there, then that is your reason for no return records. Correct the <CODE>input=</CODE> parameter on the <CODE>spath</CODE> command to be the correct field name.</P> Wed, 31 May 2017 04:30:00 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-I-rename-a-file-after-extraction/m-p/322754#M6755 DalJeanis 2017-05-31T04:30:00Z