topic Re: help on rename which doesnt works in Splunk Search

help on rename which doesnt works

jip31 — Thu, 17 Sep 2020 08:08:10 GMT

Hello

I use the search below but I don't know why the rename command doesn't works

Thanks for your help

Re: help on rename which doesnt works

ITWhisperer — Thu, 17 Sep 2020 08:14:07 GMT

Rename is for field names. You have reduced your fields to just SITE. There is no field ABCD for you to rename as AB. What is it you are trying to do?

Re: help on rename which doesnt works

thambisetty — Thu, 17 Sep 2020 08:24:51 GMT

| inputlookup fo_all | fields SITE # you are limiting fields to one field SITE, from here on you will have only one field. | dedup SITE | rename "ABCD" as "AB" # you are trying to rename field ABCD to AB which you don't have at this moment. | table SITE

Re: help on rename which doesnt works

jip31 — Thu, 17 Sep 2020 08:28:15 GMT

Hi I need to rename the items of the field SITE

Re: help on rename which doesnt works

thambisetty — Thu, 17 Sep 2020 08:31:33 GMT

okay. I believe there is an Item ABCD in your SITE field and you would want to rename it to AB. if is that what you are looking for then use below:

| inputlookup fo_all | stats count by SITE | fields SITE | eval SITE=if(SITE=="ABCD","AB",SITE)

Re: help on rename which doesnt works

ITWhisperer — Thu, 17 Sep 2020 08:40:36 GMT

Hi @jip31

What @thambisetty has suggested works fine for ABCD "renamed" to AB but I suspect this is just example data and what you want is something more generic, perhaps substr() or replace() might be more useful, you may want to consider using case() and match() to do different "renames"

Re: help on rename which doesnt works

jip31 — Thu, 17 Sep 2020 08:49:37 GMT

thanks it works