topic Re: "As" command modifier not working in Splunk Search

"As" command modifier not working

grook — Wed, 30 Sep 2020 00:21:55 GMT

New to Splunk. Trying to use the "as" command modifier to change the name of a column. However, the modifier is not being highlighted or changing the column name.

Here is my SPL string:
sourcetype="access_combined_wcookie" status=200 file="success.do"
| table JSESSIONID as UserSession

Re: "As" command modifier not working

pruthvikrishnap — Mon, 06 May 2019 23:15:00 GMT

Hi Grook,
U will have to rename the command prior to |table, such as
| rename JSESSIONID as usersession
and then call it to table

Re: "As" command modifier not working

grook — Wed, 30 Sep 2020 00:21:58 GMT

Like this?

sourcetype="access_combined_wcookie" status=200 file="success.do"
| rename JSESSIONID as UserSessions
| table UserSession

Re: "As" command modifier not working

pruthvikrishnap — Tue, 07 May 2019 00:01:19 GMT

yeah did it work?

Re: "As" command modifier not working

niketn — Tue, 07 May 2019 02:28:49 GMT

Seems typo, field name should match, so if you rename you should use exact field name afterwards.

  | rename JSESSIONID as UserSessions
  | table UserSessions

If you have space or special characters in the field name you should use double quotes. For example

  | rename JSESSIONID as "User Session IDs"
  | table "User Session IDs"