https://community.splunk.com/t5/Splunk-Search/Why-is-the-rename-command-not-working-post-using-fillnull/m-p/439214#M124965 <P>Can you please help check why below command is not working.</P> <PRE><CODE>index="app_batch_reports" "] ERROR [" NOT "MessageClient." | rex field=_raw "Generate Request to Module (?[^ ]+) Failed.+?Error \(Code: (?[^)]+)\): [\"']?(?[^\"']+?)\)?($|\n|\r)" | rex field=_raw "Error \(Code: (?[^)]+)\): (?.+?)($|\n|\r)" | rex field=_raw "ExecutionPersistenceController\.PersistScheduledReportExecution-END(.+?), Error, (?[^\"')]+)" | eval CODE=coalesce(CODE1,CODE2) | fillnull value=NULL | table CODE |rename CODE as new </CODE></PRE> <P>CODE field has all values as NULL. When I use rename command, I get no result, and without using it the query works fine. Also, if I change the fieldname from CODE to anything else, the query works fine with rename as well.</P> Tue, 18 Dec 2018 02:34:59 GMT AnmolKohli 2018-12-18T02:34:59Z https://community.splunk.com/t5/Splunk-Search/Why-is-the-rename-command-not-working-post-using-fillnull/m-p/439214#M124965 <P>Can you please help check why below command is not working.</P> <PRE><CODE>index="app_batch_reports" "] ERROR [" NOT "MessageClient." | rex field=_raw "Generate Request to Module (?[^ ]+) Failed.+?Error \(Code: (?[^)]+)\): [\"']?(?[^\"']+?)\)?($|\n|\r)" | rex field=_raw "Error \(Code: (?[^)]+)\): (?.+?)($|\n|\r)" | rex field=_raw "ExecutionPersistenceController\.PersistScheduledReportExecution-END(.+?), Error, (?[^\"')]+)" | eval CODE=coalesce(CODE1,CODE2) | fillnull value=NULL | table CODE |rename CODE as new </CODE></PRE> <P>CODE field has all values as NULL. When I use rename command, I get no result, and without using it the query works fine. Also, if I change the fieldname from CODE to anything else, the query works fine with rename as well.</P> Tue, 18 Dec 2018 02:34:59 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-the-rename-command-not-working-post-using-fillnull/m-p/439214#M124965 AnmolKohli 2018-12-18T02:34:59Z https://community.splunk.com/t5/Splunk-Search/Why-is-the-rename-command-not-working-post-using-fillnull/m-p/439215#M124966 <P>@AnmolKohli add the fieldname <CODE>CODE</CODE> to the fillnull command i.e. <CODE>| fillnull value="NULL" CODE</CODE> and confirm.<BR /> Following is a run anywhere example on similar lines for testing:</P> <PRE><CODE>| makeresults count=10 | fillnull value="NULL" CODE | table CODE | rename CODE as new </CODE></PRE> Tue, 18 Dec 2018 05:23:34 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-the-rename-command-not-working-post-using-fillnull/m-p/439215#M124966 niketn 2018-12-18T05:23:34Z