topic Re: Renaming field name having # in Splunk Search

Renaming field name having #

ccflsampa — Mon, 23 Apr 2018 19:07:35 GMT

How can I rename a field name starting with # in Splunk search tab?
For example: field name I have "#client Name" and I want to rename it as "clientName"

Thanks!

Re: Renaming field name having #

ssadanala1 — Mon, 23 Apr 2018 19:53:42 GMT

Please try this

| makeresults 
|eval "#hello" = "1"|eval "#hola"="2"
|rename #* as *

Re: Renaming field name having #

Shan — Tue, 24 Apr 2018 11:16:16 GMT

yes i accept with @ssadanala1.
I hope you need to rename the field name in spl query right. If yes is your answer.
Then you can use simple rename command and change the field name.

Example :

| makeresults
|eval "#Data" = 1
|eval "#client Name"="study"
|rename #Data as Data, "#client Name" as "client Name"

You can simply use this for renaming your field..
|rename #Data as Data, "#client Name" as "client Name"

Re: Renaming field name having #

ccflsampa — Tue, 24 Apr 2018 14:48:12 GMT

Thank you!
I am able to rename the field name with # (successfully renamed # MHCP Cases to MHCPCases)
but while saving the results to the dashboard I am getting the error (The dataset "RootObject" has no field " MHCP Cases" ). How can I avoid this error?

Re: Renaming field name having #

Shan — Fri, 27 Apr 2018 05:51:43 GMT

@ ccflsampa : I hope you got your answer. If the above commands helps. Please accept the answer and close the question.