https://community.splunk.com/t5/Splunk-Search/How-to-rename-all-the-fields-with-quot-s0-quot-at-the-end-of/m-p/399028#M115689 <P>I have this column named as "cloud-look-up_s0" and "cloud-look-up_s1" and so on and so on. so What I want to do is to rename "cloud-look-up-s0" with "cloud-look-up-Today". But here is the thing, I want to name all fields that have "s0" in the end to "Today " and the columns will have a different string attached in the front so the format would be something like:</P> <PRE><CODE>string1_s0, string1_s1 string2_s0, string1_s2 string3_s0, string1_s3 string4_s0, string1_s4 </CODE></PRE> Tue, 29 Sep 2020 20:50:42 GMT kiamco 2020-09-29T20:50:42Z https://community.splunk.com/t5/Splunk-Search/How-to-rename-all-the-fields-with-quot-s0-quot-at-the-end-of/m-p/399028#M115689 <P>I have this column named as "cloud-look-up_s0" and "cloud-look-up_s1" and so on and so on. so What I want to do is to rename "cloud-look-up-s0" with "cloud-look-up-Today". But here is the thing, I want to name all fields that have "s0" in the end to "Today " and the columns will have a different string attached in the front so the format would be something like:</P> <PRE><CODE>string1_s0, string1_s1 string2_s0, string1_s2 string3_s0, string1_s3 string4_s0, string1_s4 </CODE></PRE> Tue, 29 Sep 2020 20:50:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-rename-all-the-fields-with-quot-s0-quot-at-the-end-of/m-p/399028#M115689 kiamco 2020-09-29T20:50:42Z https://community.splunk.com/t5/Splunk-Search/How-to-rename-all-the-fields-with-quot-s0-quot-at-the-end-of/m-p/399029#M115690 <P><CODE>| rename * _s0 as *-Today</CODE></P> <P>edit: forgot code block and it wasn't showing asterix</P> Fri, 10 Aug 2018 16:57:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-rename-all-the-fields-with-quot-s0-quot-at-the-end-of/m-p/399029#M115690 anthonymelita 2018-08-10T16:57:34Z https://community.splunk.com/t5/Splunk-Search/How-to-rename-all-the-fields-with-quot-s0-quot-at-the-end-of/m-p/399030#M115691 <P>Append this to your search <CODE>| rename *_s0 as *-Today</CODE></P> Fri, 10 Aug 2018 17:12:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-rename-all-the-fields-with-quot-s0-quot-at-the-end-of/m-p/399030#M115691 sudosplunk 2018-08-10T17:12:23Z