topic Re: Remove Wildcard from Field Name in Splunk Search

Remove Wildcard from Field Name

makarand13 — Wed, 16 May 2018 06:18:30 GMT

I have some ticketing data being imported into Splunk for analysis. There are a couple of field names with an asterix (*) in them.

Example - Priority*

How do I rename such a field to just "Priority", or a non-wildcard string? Thanks !!

niketn — Wed, 16 May 2018 09:56:42 GMT

@makarand13 can you post raw events where such wildcard based fields exist?

The following could be a fix during search time however, you should rather fix it while indexing using SEDCMD

<yourBaseSearch>
|  eval priority='Priority*'
|  fields - Priority*

harishalipaka — Wed, 16 May 2018 11:07:22 GMT

| transpose 
| replace "Priority*" with Priority 
| transpose header_field=column

elliotproebstel — Wed, 16 May 2018 15:40:48 GMT

To build on this and make it rename all field names containing wildcards at once:

| transpose 
| rex field=column mode=sed "s/\*//g" 
| transpose header_field=column 
| fields - column

elliotproebstel — Wed, 16 May 2018 15:41:32 GMT

Upvoting this especially to reinforce that the best solution is to fix while indexing!