<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to achieve renaming JSON field names? in Deployment Architecture</title>
    <link>https://community.splunk.com/t5/Deployment-Architecture/How-to-achieve-renaming-JSON-field-names/m-p/627805#M26575</link>
    <description>&lt;P&gt;Try something like this&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| foreach *::*.*
    [| eval "&amp;lt;&amp;lt;MATCHSEG1&amp;gt;&amp;gt;.&amp;lt;&amp;lt;MATCHSEG3&amp;gt;&amp;gt;" = if(isnotnull('&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;'),'&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;','&amp;lt;&amp;lt;MATCHSEG1&amp;gt;&amp;gt;.&amp;lt;&amp;lt;MATCHSEG3&amp;gt;&amp;gt;')]&lt;/LI-CODE&gt;</description>
    <pubDate>Fri, 20 Jan 2023 18:07:53 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2023-01-20T18:07:53Z</dc:date>
    <item>
      <title>How to achieve renaming JSON field names?</title>
      <link>https://community.splunk.com/t5/Deployment-Architecture/How-to-achieve-renaming-JSON-field-names/m-p/627793#M26574</link>
      <description>&lt;P&gt;Hey All,&lt;BR /&gt;wondering if I can get some input on this. I have data coming in as JSON. The fields follow this naming convention:&lt;BR /&gt;&lt;BR /&gt;objects.&lt;STRONG&gt;Server::34385&lt;/STRONG&gt;.fields.friendlyname = Server123&lt;BR /&gt;objects.&lt;STRONG&gt;Server::88634&lt;/STRONG&gt;.fields.friendlyname = Server444&lt;BR /&gt;&lt;BR /&gt;What I'm trying to do is to somehow rename the fields, so I omit the ::&amp;lt;number&amp;gt; after the Server part.&lt;BR /&gt;End result is needed to be like this:&lt;BR /&gt;objects.&lt;STRONG&gt;Server&lt;/STRONG&gt;.fields.friendlyname = Server123&lt;BR /&gt;objects.&lt;STRONG&gt;Server&lt;/STRONG&gt;.fields.friendlyname = Server444&lt;BR /&gt;&lt;BR /&gt;It's worth mentioning that there are around 10k servers, so I can't list them out one by one.&lt;/P&gt;</description>
      <pubDate>Fri, 20 Jan 2023 17:18:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Deployment-Architecture/How-to-achieve-renaming-JSON-field-names/m-p/627793#M26574</guid>
      <dc:creator>dvuchev</dc:creator>
      <dc:date>2023-01-20T17:18:51Z</dc:date>
    </item>
    <item>
      <title>Re: How to achieve renaming JSON field names?</title>
      <link>https://community.splunk.com/t5/Deployment-Architecture/How-to-achieve-renaming-JSON-field-names/m-p/627805#M26575</link>
      <description>&lt;P&gt;Try something like this&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| foreach *::*.*
    [| eval "&amp;lt;&amp;lt;MATCHSEG1&amp;gt;&amp;gt;.&amp;lt;&amp;lt;MATCHSEG3&amp;gt;&amp;gt;" = if(isnotnull('&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;'),'&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;','&amp;lt;&amp;lt;MATCHSEG1&amp;gt;&amp;gt;.&amp;lt;&amp;lt;MATCHSEG3&amp;gt;&amp;gt;')]&lt;/LI-CODE&gt;</description>
      <pubDate>Fri, 20 Jan 2023 18:07:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Deployment-Architecture/How-to-achieve-renaming-JSON-field-names/m-p/627805#M26575</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2023-01-20T18:07:53Z</dc:date>
    </item>
    <item>
      <title>Re: How to achieve renaming JSON field names?</title>
      <link>https://community.splunk.com/t5/Deployment-Architecture/How-to-achieve-renaming-JSON-field-names/m-p/627814#M26576</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;Thanks so much, was able to get what I needed with the | foreach&lt;BR /&gt;&lt;BR /&gt;Marking as solution and DM&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 20 Jan 2023 19:01:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Deployment-Architecture/How-to-achieve-renaming-JSON-field-names/m-p/627814#M26576</guid>
      <dc:creator>dvuchev</dc:creator>
      <dc:date>2023-01-20T19:01:13Z</dc:date>
    </item>
  </channel>
</rss>

