rename a field

Pandey_21 — Fri, 24 May 2024 07:39:40 GMT

Hi All,

I am trying to rename a data but it is giving me error. I am doing in this way.

| rename "Data Time series* *errorcount=0" AS "Success"

but error is : Error in 'rename' command: Wildcard mismatch: 'Data Time series* *errorcount=0' as 'Success'.

Log file:

Data Time series :: DataTimeSeries{requestId='482-fd1e-47-49-bf9b99f8', errorcount=0,

Can you please help me with correct rename command.

Re: rename a field

gcusello — Fri, 24 May 2024 07:46:10 GMT

rename is a command to rename field names not to replace a string, use replace (https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Replace) or rex to do this:

| replace "Data Time series* errorcount=0" AS "Success"

Ciao.

Giuseppe