https://community.splunk.com/t5/Splunk-Search/Spath-and-Rename/m-p/358932#M106089 <P>Hi, I wonder whether someone may be able to help me please.</P> <P>I'm trying to create a query which extracts given values using 'spath'.</P> <P>This is what I've come up with so far:</P> <PRE><CODE>| multisearch [ search `cc-frontend_wmf(cCurrentYearIncome)`] [ search `cc-frontend_wmf(pCurrentYearIncome)`] | spath output=claimant path=detail.cCurrentYearIncome | spath output=partner path=detail.pCurrentYearIncome </CODE></PRE> <P>I can create the "claimant" and "partner" fields, but I then need to perform a rename and this is where I have the problem because the fields I need to rename have the same name as shown below.</P> <P><STRONG>field=claim</STRONG> need to rename currentIncome.employmentIncome as ccurrent<BR /> <STRONG>field=part</STRONG> need to rename currentIncome.employmentIncome as pcurrent</P> <P>Could someone tell me please is there a way to differentiate the two fields ie. is there a way to rename when I create the spath?</P> <P>Many thanks and kind regards</P> <P>Chris</P> Tue, 20 Jun 2017 08:22:52 GMT IRHM73 2017-06-20T08:22:52Z https://community.splunk.com/t5/Splunk-Search/Spath-and-Rename/m-p/358932#M106089 <P>Hi, I wonder whether someone may be able to help me please.</P> <P>I'm trying to create a query which extracts given values using 'spath'.</P> <P>This is what I've come up with so far:</P> <PRE><CODE>| multisearch [ search `cc-frontend_wmf(cCurrentYearIncome)`] [ search `cc-frontend_wmf(pCurrentYearIncome)`] | spath output=claimant path=detail.cCurrentYearIncome | spath output=partner path=detail.pCurrentYearIncome </CODE></PRE> <P>I can create the "claimant" and "partner" fields, but I then need to perform a rename and this is where I have the problem because the fields I need to rename have the same name as shown below.</P> <P><STRONG>field=claim</STRONG> need to rename currentIncome.employmentIncome as ccurrent<BR /> <STRONG>field=part</STRONG> need to rename currentIncome.employmentIncome as pcurrent</P> <P>Could someone tell me please is there a way to differentiate the two fields ie. is there a way to rename when I create the spath?</P> <P>Many thanks and kind regards</P> <P>Chris</P> Tue, 20 Jun 2017 08:22:52 GMT https://community.splunk.com/t5/Splunk-Search/Spath-and-Rename/m-p/358932#M106089 IRHM73 2017-06-20T08:22:52Z https://community.splunk.com/t5/Splunk-Search/Spath-and-Rename/m-p/358933#M106090 <P>Hi,</P> <P>I've fixed the issue by using the following:</P> <PRE><CODE>| spath output=current input=detail.cCurrentYearIncome path=currentIncome.employmentIncome | spath output=pcurrent input=detail.pCurrentYearIncome path=currentIncome.employmentIncome </CODE></PRE> <P>Many thanks</P> <P>Chris</P> Tue, 20 Jun 2017 09:58:04 GMT https://community.splunk.com/t5/Splunk-Search/Spath-and-Rename/m-p/358933#M106090 IRHM73 2017-06-20T09:58:04Z