topic Re: Rename a Column? in Splunk Search

Rename a Column?

JohnWright8 — Tue, 29 Sep 2020 07:13:40 GMT

I'm processing some IIS log files with a search:
stats count max(time_taken) avg(time_taken) as avgTT by cs_uri_stem | fieldformat avgTT=round(avgTT/1000,2) |rename avgTT as "Avg Response Time"

But the result displays a column for both "Avg Response Time" (which seems to lack the rounding I just did) and ALSO displays an (empty) column named avgTT.

How do I do a search and then simply change the text of the column title?

Re: Rename a Column?

somesoni2 — Fri, 04 Sep 2015 13:17:59 GMT

Try this

your base search | stats count max(time_taken)  avg(time_taken) as avgTT by cs_uri_stem | eval avgTT=round(avgTT/1000,2) |rename avgTT as "Avg Response Time"

Re: Rename a Column?

JohnWright8 — Fri, 04 Sep 2015 13:22:41 GMT

Thank you! This works. For some reason "eval" works when "fieldformat" doesn't. Doesn't make any logical sense to me but thank you very much for providing a working solution!