topic Re: Can I rename different fields the same thing? in Splunk Search

Can I rename different fields the same thing?

Federica_92 — Tue, 14 Apr 2015 11:15:46 GMT

I'm working with a dataset that lists companies and individual people, so that some entries have the field "Entity Name" and some have "Individual Name". I'd like to output a table with both of these fields shown under a single "Name" field. When I try to rename them both by this title, though, the second command overwrites the first one. Is there a way to have both fields listed under the same title, while keeping them as separate events?

Re: Can I rename different fields the same thing?

Runals — Tue, 14 Apr 2015 11:19:30 GMT

I often use coalesce in these cases; hopefully it will work in yours.

... | eval name = coalesce(entityName, individualName) | ...

This assumes every event will have either one or the other field. Otherwise I think if it has both it will grab the fields in the order listed. I often use that for especially Windows logs where the field used might be different for the same type of event based on OS version or specific event ID.

Re: Can I rename different fields the same thing?

Runals — Tue, 14 Apr 2015 11:21:18 GMT

Another way to do it might be something like

... | eval name = if(isnotnull(entityName), entityName, individualName) | ...

Re: Can I rename different fields the same thing?

NOUMSSI — Tue, 14 Apr 2015 11:32:29 GMT

Hi,
Try this

...|rename "Entity Name"  as EntityName| rename "Individual Name"  as IndividualName |eval name=EntityName  +  IndividualName |...

Re: Can I rename different fields the same thing?

fdi01 — Tue, 14 Apr 2015 11:55:56 GMT

u can try like this:
... |rename entityName as Name |eval Name ="companie name:" + Name + "and people name:" + individualName | ...

Re: Can I rename different fields the same thing?

stephane_cyrill — Tue, 14 Apr 2015 12:14:38 GMT

Hi Federica_92,

I the following can solve your problem:

.........|eval SingleName=mvzip(entityName, individualName)| makemv delim="," SingleName|mvexpand SingleName

For Example if you want to have both host and soure in the same field call SingleName :

index=*|table host source|eval SingleName=mvzip(host,source)| makemv delim="," SingleName|mvexpand SingleName

I hope you will be satisfied.

Re: Can I rename different fields the same thing?

Robwhoa78 — Fri, 25 Oct 2024 22:57:35 GMT

What if you have multiple that you want to rename the same?

| rename "Message.TaskInfo.CarHop Backup.LastResult"="-2147020576" AS Result | rename "Message.TaskInfo.CarHop Backup.LastResult"=1 AS Result | rename "Message.TaskInfo.CarHop Backup.LastResult"=0 AS Result | rename "Message.TaskInfo.AI Restart Weekly.LastResult"=267011 AS Result | rename "Message.TaskInfo.CarHop Backup.LastResult"=267009 AS Result | rename "Message.TaskInfo.CarHop Backup.LastResult"=2 AS Result

This is not working for me