topic Re: Why isn't the rename command not renaming fields? in Splunk Search

Why isn't the rename command not renaming fields?

payton_tayvion — Thu, 29 Aug 2019 14:41:03 GMT

I'm currently creating a list that lists top 10 technologies and I'm trying to rename "Red" as "Red Hat" using the rename command.
Here's the query:

| tstats summariesonly=f dc(Vulnerabilities.signature) as count from datamodel="Vulnerabilitiesv3" where (nodename="Vulnerabilities" (Vulnerabilities.severity!=informational Vulnerabilities.severity!=unknown) Vulnerabilities.dest_bunit IN (*) Vulnerabilities.property IN (*) ) by Vulnerabilities.dest, Vulnerabilities.signature, Vulnerabilities.point_of_contact, Vulnerabilities.solution
| rename Vulnerabilities.* AS * 
| rename signature as sig
| lookup workday.csv shortid as point_of_contact output l1, l2,l3,l4
| search (l1="*" OR l2="*" OR l3="*" OR l4="*")
| fields - point_of_contact
| rex field=sig "^(?<Technology>[^\W]++)"
| stats sum(count) as count by Technology
| sort- count 
| head 10
| rename Red as "Red Hat"

This is the results:

Technology  count
 RHEL   6906424
Oracle  1507478
CentOS  402534
Network 186231
Ubuntu  129319
Red 109693

Re: Why isn't the rename command not renaming fields?

Sukisen1981 — Thu, 29 Aug 2019 15:11:53 GMT

you can rename technology as something else or count as say counts , to achieve this
try
|eval Technology=case(Technology="Red","Red Hat")

Re: Why isn't the rename command not renaming fields?

mayurr98 — Thu, 29 Aug 2019 15:14:31 GMT

try this :

| tstats summariesonly=f dc(Vulnerabilities.signature) as count from datamodel="Vulnerabilitiesv3" where (nodename="Vulnerabilities" (Vulnerabilities.severity!=informational Vulnerabilities.severity!=unknown) Vulnerabilities.dest_bunit IN (*) Vulnerabilities.property IN (*) ) by Vulnerabilities.dest, Vulnerabilities.signature, Vulnerabilities.point_of_contact, Vulnerabilities.solution
 | rename Vulnerabilities.* AS * 
 | rename signature as sig
 | lookup workday.csv shortid as point_of_contact output l1, l2,l3,l4
 | search (l1="*" OR l2="*" OR l3="*" OR l4="*")
 | fields - point_of_contact
 | rex field=sig "^(?<Technology>[^\W]++)"
 | stats sum(count) as count by Technology
 | sort- count 
 | head 10
 | replace Red WITH "Red Hat" IN  Technology

let me know if this helps!

Re: Why isn't the rename command not renaming fields?

woodcock — Thu, 29 Aug 2019 15:28:35 GMT

You are using the wrong command. The rename command is for field names whereas the replace command is for field values. You need the latter.

Re: Why isn't the rename command not renaming fields?

payton_tayvion — Thu, 29 Aug 2019 16:04:24 GMT

This only shows Red Hat results for some reason