https://community.splunk.com/t5/Splunk-Search/Rename-the-Values-in-the-Json-fields/m-p/530760#M149939 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/224665">@Supriya</a>&nbsp;</P><P>Do you want to remove spaces between Summary field values or new lines ?</P> Wed, 25 Nov 2020 06:09:00 GMT thambisetty 2020-11-25T06:09:00Z https://community.splunk.com/t5/Splunk-Search/Rename-the-Values-in-the-Json-fields/m-p/530753#M149936 <P>Hi,</P><P>Could someone please help me with the rename of the string Values in the fields.</P><P>I want to remove the spaces from the below-highlighted values</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Supriya_0-1606282997524.png" style="width: 565px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/12050iB1EE36DC26CD562E/image-dimensions/565x486?v=v2" width="565" height="486" role="button" title="Supriya_0-1606282997524.png" alt="Supriya_0-1606282997524.png" /></span></P><P>here is the query I'm trying :</P><P>index="index" sourcetype=_json<BR />|spath path="results{}.summary" output=Summary| spath path="results{}.description" output=Description<BR />|spath path="results{}.category" output=Category |spath path="results{}.sysAdmin" output=SysAdmin<BR />|rename Values(Summary) as values|rename values("User deactivated") AS "User_deactivated"<BR />| table Summary Category SysAdmin</P> Wed, 25 Nov 2020 05:45:01 GMT https://community.splunk.com/t5/Splunk-Search/Rename-the-Values-in-the-Json-fields/m-p/530753#M149936 Supriya 2020-11-25T05:45:01Z https://community.splunk.com/t5/Splunk-Search/Rename-the-Values-in-the-Json-fields/m-p/530760#M149939 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/224665">@Supriya</a>&nbsp;</P><P>Do you want to remove spaces between Summary field values or new lines ?</P> Wed, 25 Nov 2020 06:09:00 GMT https://community.splunk.com/t5/Splunk-Search/Rename-the-Values-in-the-Json-fields/m-p/530760#M149939 thambisetty 2020-11-25T06:09:00Z https://community.splunk.com/t5/Splunk-Search/Rename-the-Values-in-the-Json-fields/m-p/530765#M149940 <P>removing spaces between Summary field values</P> Wed, 25 Nov 2020 06:47:21 GMT https://community.splunk.com/t5/Splunk-Search/Rename-the-Values-in-the-Json-fields/m-p/530765#M149940 Supriya 2020-11-25T06:47:21Z https://community.splunk.com/t5/Splunk-Search/Rename-the-Values-in-the-Json-fields/m-p/530766#M149941 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/224665">@Supriya</a>&nbsp;&nbsp;</P><P>try below:</P><LI-CODE lang="markup">| rex field=Summary mode=sed "s/\s+//g"</LI-CODE><P>&nbsp;</P> Wed, 25 Nov 2020 06:54:13 GMT https://community.splunk.com/t5/Splunk-Search/Rename-the-Values-in-the-Json-fields/m-p/530766#M149941 thambisetty 2020-11-25T06:54:13Z https://community.splunk.com/t5/Splunk-Search/Rename-the-Values-in-the-Json-fields/m-p/530767#M149942 <P>It's working,</P><P>Thank you very much for your prompt support <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/129407">@thambisetty</a>&nbsp;</P> Wed, 25 Nov 2020 06:58:16 GMT https://community.splunk.com/t5/Splunk-Search/Rename-the-Values-in-the-Json-fields/m-p/530767#M149942 Supriya 2020-11-25T06:58:16Z