topic How to rename columns in a chart that cam from nested json? in Splunk Search

How to rename columns in a chart that cam from nested json?

thisissplunk — Sat, 02 Oct 2021 23:50:18 GMT

I have a nested json element that gives back up to 8 field names. I table them like:

| table "Config.DiskBrandSize.*"

Which has child elements like:

Barracuda: 100gb Seagate: 50gb Sandisk: 150gb

I then sum them up:

| chart sum("Config.DiskBrandSize.*")

and I get a table with columns like "sum(Config.DiskBrandSize{}.Sandisk)".

But I want to rename that to just something like "SandiskTotal" which is created from the column name + "Total", NOT do manual renames. I can't figure out how to do this with a foreach either.

Re: How to rename columns in a chart that cam from nested json?

richgalloway — Sun, 03 Oct 2021 00:08:58 GMT

I know you said no manual renames, but the rename command is the one to use. Like this:

| rename "Config.DiskBrandSize.*" as *Total

Re: How to rename columns in a chart that cam from nested json?

thisissplunk — Sun, 03 Oct 2021 01:33:09 GMT

Thanks, I didn't use rename but I used the same concept in the stats and chart commands.