https://community.splunk.com/t5/Splunk-Search/How-to-rename-multiple-field-names-with-certain-criteria/m-p/342731#M101524 <P>How do I replace the <CODE>MB</CODE> in each field name with <CODE>GB</CODE> ??</P> <PRE><CODE>_time XXX-XX-MB XXX-XXX-MB XXXXXXMB_XX_XXX 1 2017-07-30 11:00 1391.67548628852 1381.60821617188 1274.532780647 2 2017-07-30 12:00 1509.29349191985 1503.65362613860 1373.894662857 </CODE></PRE> <P>So my result would look like this:</P> <PRE><CODE>_time XXX-XX-GB XXX-XXX-GB XXXXXXGB_XX_XXX 1 2017-07-30 11:00 1391.67548628852 1381.60821617188 1274.532780647 2 2017-07-30 12:00 1509.29349191985 1503.65362613860 1373.894662857 </CODE></PRE> <P>I can already change all the field values with this command and was thinking I could do something similar with the field names. <BR /> <CODE>foreach * [eval &lt;&lt;FIELD&gt;&gt;='&lt;&lt;FIELD&gt;&gt;'/1024] |</CODE></P> Sun, 30 Jul 2017 23:55:48 GMT HattrickNZ 2017-07-30T23:55:48Z https://community.splunk.com/t5/Splunk-Search/How-to-rename-multiple-field-names-with-certain-criteria/m-p/342731#M101524 <P>How do I replace the <CODE>MB</CODE> in each field name with <CODE>GB</CODE> ??</P> <PRE><CODE>_time XXX-XX-MB XXX-XXX-MB XXXXXXMB_XX_XXX 1 2017-07-30 11:00 1391.67548628852 1381.60821617188 1274.532780647 2 2017-07-30 12:00 1509.29349191985 1503.65362613860 1373.894662857 </CODE></PRE> <P>So my result would look like this:</P> <PRE><CODE>_time XXX-XX-GB XXX-XXX-GB XXXXXXGB_XX_XXX 1 2017-07-30 11:00 1391.67548628852 1381.60821617188 1274.532780647 2 2017-07-30 12:00 1509.29349191985 1503.65362613860 1373.894662857 </CODE></PRE> <P>I can already change all the field values with this command and was thinking I could do something similar with the field names. <BR /> <CODE>foreach * [eval &lt;&lt;FIELD&gt;&gt;='&lt;&lt;FIELD&gt;&gt;'/1024] |</CODE></P> Sun, 30 Jul 2017 23:55:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-rename-multiple-field-names-with-certain-criteria/m-p/342731#M101524 HattrickNZ 2017-07-30T23:55:48Z https://community.splunk.com/t5/Splunk-Search/How-to-rename-multiple-field-names-with-certain-criteria/m-p/342732#M101525 <P>try this!</P> <PRE><CODE>(your search)|rename *_mb* as *_gb*|foreach *_gb* [eval &lt;&lt;FIELD&gt;&gt;='&lt;&lt;FIELD&gt;&gt;'/1024] </CODE></PRE> Mon, 31 Jul 2017 00:53:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-rename-multiple-field-names-with-certain-criteria/m-p/342732#M101525 HiroshiSatoh 2017-07-31T00:53:37Z