topic Re: Bulk rename fields by regex pattern in Splunk Search

Bulk rename fields by regex pattern

Cuyose — Tue, 31 Jul 2018 17:20:28 GMT

Basically I have a bunch of fields that are coming in foo.date.blah, where date is dynamic and the foo and blah are static.

I want to basically just coalesce or bulk rename these all into a field labeled foo.blah.

Re: Bulk rename fields by regex pattern

sudosplunk — Tue, 31 Jul 2018 18:34:44 GMT

There's a possibility of doing this by rex. Can you provide some sample events?

Re: Bulk rename fields by regex pattern

niketn — Tue, 31 Jul 2018 19:51:35 GMT

@Cuyose some sample field names and their values per event would help us assist you better.
Why you need coalesce()? What if multiple date fields are not null but are different?

Re: Bulk rename fields by regex pattern

somesoni2 — Tue, 31 Jul 2018 20:26:06 GMT

Give this a try

Your current search giving all fool.<date>.blah type fields
| eval "foo.blah"=null() | foreach foo.*.blah [| eval "foo.blah"=coalesce('<<FIELD>>','foo.blah')]

See this runanywhere sample (instead of dates I used numbers but should work the same way for dates)

| gentimes start=-1 | eval "foo.12.blah"=1 | table foo* | append [| gentimes start=-1 | eval "foo.13.blah"=2 | table foo*]  | append [| gentimes start=-1 | eval "foo.14.blah"=3 | table foo*]
| eval "foo.blah"=null() | foreach foo.*.blah [| eval "foo.blah"=coalesce('<<FIELD>>','foo.blah')]

Re: Bulk rename fields by regex pattern

Cuyose — Tue, 31 Jul 2018 21:22:37 GMT

For whatever reason, this still is not working. Your example works, however replacing verbatim the foo and bar sections with my own data fails to parse out the information.

Re: Bulk rename fields by regex pattern

Cuyose — Wed, 01 Aug 2018 14:48:34 GMT

The field names are as follows
codeDropUploadMap.20180828..qcTickets
codeDropUploadMap.20180711..qcTickets
codeDropUploadMap.20180804..qcTickets
etc.

The data contained within is a comma delimited string of id's. each row only has values for one of the columns, if any.

I used your format to do something similar with another field and it worked fine. I think it might have to do with the data within?