topic Re: Is it possible to change case of a column name? in Splunk Search

Is it possible to change case of a column name?

ma_anand1984 — Mon, 15 Jul 2013 05:51:05 GMT

I would like to change case of column name. Is it possible. My column name changes at run time and is not known at the time of writing the query

Re: Is it possible to change case of a column name?

asimagu — Mon, 28 Sep 2020 14:21:07 GMT

I am guessing you want the column name to be renamed for the result of the search?

If that is the case you can pipe your search to

| rename column_name AS "your_new_name"

if you want to change the name of the field before doing calculations with the new name, you should use the eval command

| eval new_name=old_name

Re: Is it possible to change case of a column name?

ma_anand1984 — Mon, 28 Sep 2020 14:21:18 GMT

@asimagu Thanks for your reply but it didnt answer my query. I dont know the column name. it is created at run time.
| rename column_name AS "your_new_name". i want "your_new_name" to be like "COLUMN_NAME" - upper case of whatever is present in the column

Re: Is it possible to change case of a column name?

grantsmiley — Tue, 16 Oct 2018 12:08:06 GMT

see if this helps you
| foreach * [| eval "uppered<<MATCHSTR>>"='<<MATCHSTR>>' ]

Re: Is it possible to change case of a column name?

grantsmiley — Tue, 16 Oct 2018 12:10:44 GMT

That's a way to get the dynamic column name thing solved.

Re: Is it possible to change case of a column name?

DalJeanis — Tue, 16 Oct 2018 14:06:01 GMT

If you want ALL fieldnames to be upper case, then do this at the end...

| streamstats count as recno
| untable recno fieldname fieldvalue
| eval fieldname = upper(fieldname)
| xyseries recno fieldname fieldvalue
| fields - recno

Be aware that the above code will turn multivalue fields to single value fields as if they had been nomved. The following code will protect an mv field called "foo".

| streamstats count as recno
| eval foo = mvjoin(foo,"!!!!")
| untable recno fieldname fieldvalue
| eval fieldname = upper(fieldname)
| xyseries recno fieldname fieldvalue
| eval FOO = split(FOO,"!!!!")
| fields - recno