topic Re: Renaming splunk column names in Splunk Search

How to rename Splunk column names?

nibinabr — Fri, 10 Feb 2023 20:52:19 GMT

Hi,

I have a query that evaluates the value of a variable like this

*...|eval var1= var2*10|....*

where var1 and var2 are variables.

Now I need to rename the column header by doing something like this

*rename column_name as "Number ".var1." is good"* .

But the output I see is *"Number ".var1." is good"* and var1 is not getting replaced by the value. What is the right way of doing this ?

Any help will be appreciated.

Re: Renaming splunk column names

martin_mueller — Tue, 18 Nov 2014 20:43:05 GMT

rename can't access column values. Try this:

... | eval Number {var1} is good = column_name | fields - column_name

Re: Renaming splunk column names

nibinabr — Tue, 18 Nov 2014 21:33:18 GMT

Thanks @martin_muller for the quick reply. I tried your solution and now the column in the output now changed to "Number is good". It is not printing the value of var1 between "Number" and "is".

Re: Renaming splunk column names

martin_mueller — Tue, 18 Nov 2014 21:51:00 GMT

Try running this dummy example:

| stats count | eval var1="42 43 44" | makemv var1 | mvexpand var1 | eval column_name = "foo" | eval Number {var1} is good = column_name | fields - column_name

Re: Renaming splunk column names

nibinabr — Mon, 28 Sep 2020 18:12:58 GMT

I really appreciate you sharing this example. It is bit confusing that it doesn't work for me when I have the value of var1 being calculated just after my query. When I moved this calculation just before the eval Number {var1} is good = column_name | fields - column_name, it worked for me.

Re: Renaming splunk column names

martin_mueller — Tue, 18 Nov 2014 22:24:33 GMT

Well, it can't use values from the future...

Re: Renaming splunk column names

nibinabr — Mon, 28 Sep 2020 18:12:07 GMT

I mean
stats.....|eval var1=var2*10|....|....|......|....|eval Number {var1} is good = column_name | fields - column_name
didnot work for me.

It worked when I changed the above to
stats.....|....|....|......|....|eval var1=var2*10|eval Number {var1} is good = column_name | fields - column_name

Re: Renaming splunk column names

sukansingh — Fri, 10 Feb 2023 05:05:30 GMT

what if variable is holding the column_name and then I want to sort that column.

for example

my_search | eval date="2023-02-02" | sort - $date

is it possible to sort by column name which is dynamically generated So i won't know the exact name But variable holds the column name So I can just use sort - $Variable?

Re: Renaming splunk column names

bowesmana — Fri, 10 Feb 2023 05:23:36 GMT

Please post this as a new question rather than asking a different variant of another question on an 8 year old answer question. It will get more attention.