topic Re: Bulk rename of all fields that come from calling "| lookup"? in Splunk Search

Bulk rename of all fields that come from calling "| lookup"?

woodcock — Sat, 28 Jul 2018 01:41:51 GMT

We have a CMDB lookup that adds 100 fields when we do not specify a limited set with "OUTPUT". More fields are added every now and then. I cannot rename the fields in the file because too many people share this file; it is what it is. Is there a flexible way to rename all fields that are in there that will still work even when new fields are added or old field names change slightly? If I jus.t do an iteration of every field with | rename a AS CMDB_a, | rename b AS CMDB_b ... this will be fragile and break and be a huge blight in the middle of my search. I cannot do | rename * AS CMDB_* because there are many other fields and this search might change to add more non-CMDB fields, too.

Re: Bulk rename of all fields that come from calling "| lookup"?

Noah_Woodcock — Sat, 28 Jul 2018 01:42:39 GMT

Like this:

... | rename * AS _HIDE_ALL_FIELDS_*
| lookup YourLookupDefinitionHere host AS _HIDE_ALL_FIELDS_host
| rename * AS CMDB_*
| rename _HIDE_ALL_FIELDS_* AS *

Re: Bulk rename of all fields that come from calling "| lookup"?

Noah_Woodcock — Sat, 28 Jul 2018 01:43:00 GMT

Like this:

... | lookup YourLookupDefinitionHere host
| rename COMMENT AS "Bulk rename of all fields from this lookup to add prefix 'CMDB_'"
| rename [| inputlookup  YourLookupDefinitionHere
          | head 1
          | foreach * [ eval <<FIELD>> = "CMDB_<<FIELD>>" ]
          | format "" "" "" "" "" ""
| rex field=search mode=sed "s/=/ AS /g"]

Re: Bulk rename of all fields that come from calling "| lookup"?

theady — Thu, 25 Apr 2019 18:33:52 GMT

I had issue with this. it seems to take the _* fields as part of the * on the first rename.

Re: Bulk rename of all fields that come from calling "| lookup"?

woodcock — Fri, 26 Apr 2019 04:43:41 GMT

It definitely should not and is a bug if it does.

Re: Bulk rename of all fields that come from calling "| lookup"?

bowesmana — Fri, 12 Jun 2020 06:46:20 GMT

Came across this solution and noted the comments about _ fields being renamed and it does appear that it won't work as _ fields are also renamed with *

| makeresults | eval myField=1 | rename * as HIDE_* | table *

shows HIDE__time

and in my example

| rename * as _HIDE_ALL_* | lookup work_status key as _HIDE_ALL_workStatusKey | rename * as orig_work_status_* | rename _HIDE_ALL_* as *

after the second rename, all _HIDE_ fields are now orig_work_status__HIDE_...

which is not the intended outcome - shame - as it was a simple approach.

Re: Bulk rename of all fields that come from calling "| lookup"?

davewood — Wed, 19 May 2021 12:05:00 GMT

It seems the rename command changed behaviour somewhere along the way and now, as you noted, * matches _ fields too.

You can still use the same method though with a tweak to the final rename:

| rename * as _HIDE_ALL_* | lookup work_status key as _HIDE_ALL_workStatusKey | rename * as orig_work_status_* | rename orig_work_status__HIDE_ALL_* as *