topic Re: renaming fields in search in Splunk Search

renaming fields in search

asarolkar — Fri, 18 May 2012 16:46:26 GMT

I have a query like this

sourcetype="beta" index="alpha" | table fieldA, fieldB, fieldC

how do I rename fields fieldA to A, fieldB to B and fieldC to C

These fields are strings AND numbers (not sure how I would use stats or table)

Re: renaming fields in search

sdaniels — Fri, 18 May 2012 17:06:17 GMT

you can use the rename command .... | rename fieldA AS newname, fieldB AS b | table newname, b

Re: renaming fields in search

asarolkar — Fri, 18 May 2012 17:28:22 GMT

yup.. thanks a bunch

Re: renaming fields in search

cam343 — Fri, 14 Jun 2013 05:32:36 GMT

While the above works, you are probably better expanding rename command instead of piping to rename for every field you want renamed.

eg. | rename fieldA AS newnameA, fieldB AS newnameB, fieldC AS newnameC

instead of:
| rename fieldA AS newnameA |rename fieldB AS newnameB |rename fieldC AS newnameC

Re: renaming fields in search

sdaniels — Fri, 14 Jun 2013 16:26:40 GMT

Agreed, I just changed it.

Re: renaming fields in search

asarran — Tue, 29 Sep 2020 10:35:30 GMT

Hey, fellow Splunkers,

When I actually attempted to conduct multiple rename fields using that method, I receive the following error: rename [old_name AS/TO/-> new_name]+

Re: renaming fields in search

cam343 — Fri, 12 Aug 2016 02:00:23 GMT

Can you post the search it should be like:

| rename user_name AS user, src AS "IP Address", host AS "Server Name"

hope that helps...

Re: renaming fields in search

landen99 — Wed, 01 Feb 2017 19:59:16 GMT

Perhaps more elegant (and practical for many fields) to do:

| rename field* AS *

Re: renaming fields in search

jbuckner85 — Thu, 23 May 2019 15:40:52 GMT

Thank you, this is very useful!