topic Rename a Column When Using Stats Function in Splunk Search

Rename a Column When Using Stats Function

SplunkLunk — Mon, 03 Apr 2017 15:27:53 GMT

Good morning,

This must be really simple. I have the query:

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" by user|sort -Count

I want to rename the user column to "User". I'm particular and like my words/heading capitalized. I've tried:

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" values(user) as User by User|sort -Count

I get the following error:

Error in 'stats' command: The output field 'User' cannot have the same name as a group-by field.

I've tried some other things as well and no luck. The closest I got was

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" values(user) as User by user|sort -Count

and that created two columns with the same data (user and User). I suppose I could delete the "user" column from the final output. Any suggestions? Thanks.

Re: Rename a Column When Using Stats Function

kiran331 — Mon, 03 Apr 2017 15:31:28 GMT

try this one..

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" by user|sort -Count|rename user as User

Re: Rename a Column When Using Stats Function

DalJeanis — Mon, 03 Apr 2017 15:37:34 GMT

I'm surprised that splunk let you do that last one. At one point the search manual says you CANT use a group by field as one of the stats fields, and gives an example of creating a second field with eval in order to make that work.

KIran331's answer is correct, just use the rename command after the stats command runs. (... Or before, that works as well.)

Re: Rename a Column When Using Stats Function

gehinger — Mon, 03 Apr 2017 15:40:49 GMT

You can pipe a table after your stats and then rename your table fields:
base_search | stats count by field1,field2| table field1 field2 count | rename field1 as NewFieldName1

Re: Rename a Column When Using Stats Function

SplunkLunk — Mon, 03 Apr 2017 15:47:11 GMT

Thanks. I figured I'd be able to do it within the stats function. I should have tried rename after sort. Thanks again.