https://community.splunk.com/t5/Splunk-Search/Remove-spaces-in-field-values-and-run-stats-timechart-with-new/m-p/217275#M63833 <P>OK, so the problem is not that your field <CODE>name</CODE> has spaces but rather that your field <CODE>value</CODE> does. So you do not need <CODE>rename</CODE>, you need something else. Try using this (<EM>early</EM> in your command chain):</P> <PRE><CODE>... | rex field="Current City" mode=sed "s/ /_/g" </CODE></PRE> Thu, 23 Jun 2016 15:29:04 GMT woodcock 2016-06-23T15:29:04Z https://community.splunk.com/t5/Splunk-Search/Remove-spaces-in-field-values-and-run-stats-timechart-with-new/m-p/217274#M63832 <P>I notice Splunk uses the first Word when using stats, so I need to rename the fields to single words or connected words.</P> <P>I am trying to remove spaces in field names and use the new name to be used in drop-downs and timecharts. Till now, I've been unable to perform this. Following is a drop-down menu where<BR /> I only want unique City Names. I would also want to use the new names in stats.</P> <PRE><CODE> source=location sourcetype=location_data | search * "Current City" | dedup "Current City" | sort "Current City" | rename "Current City" as City | rename "Current State" as State | rename "Current Location" as Location | fields City </CODE></PRE> Wed, 22 Jun 2016 21:23:05 GMT https://community.splunk.com/t5/Splunk-Search/Remove-spaces-in-field-values-and-run-stats-timechart-with-new/m-p/217274#M63832 smhsplunk 2016-06-22T21:23:05Z https://community.splunk.com/t5/Splunk-Search/Remove-spaces-in-field-values-and-run-stats-timechart-with-new/m-p/217275#M63833 <P>OK, so the problem is not that your field <CODE>name</CODE> has spaces but rather that your field <CODE>value</CODE> does. So you do not need <CODE>rename</CODE>, you need something else. Try using this (<EM>early</EM> in your command chain):</P> <PRE><CODE>... | rex field="Current City" mode=sed "s/ /_/g" </CODE></PRE> Thu, 23 Jun 2016 15:29:04 GMT https://community.splunk.com/t5/Splunk-Search/Remove-spaces-in-field-values-and-run-stats-timechart-with-new/m-p/217275#M63833 woodcock 2016-06-23T15:29:04Z https://community.splunk.com/t5/Splunk-Search/Remove-spaces-in-field-values-and-run-stats-timechart-with-new/m-p/217276#M63834 <P>Excellent this works, is it possible to do the same thing without removing spaces ? Keeping column values as it is ?</P> Thu, 23 Jun 2016 18:41:19 GMT https://community.splunk.com/t5/Splunk-Search/Remove-spaces-in-field-values-and-run-stats-timechart-with-new/m-p/217276#M63834 smhsplunk 2016-06-23T18:41:19Z https://community.splunk.com/t5/Splunk-Search/Remove-spaces-in-field-values-and-run-stats-timechart-with-new/m-p/217277#M63835 <P>Yes, you can protect your values by surrounding the field name references with double-quotes or dollar-signs. It all depends on your actual XML and search.</P> Thu, 23 Jun 2016 18:48:35 GMT https://community.splunk.com/t5/Splunk-Search/Remove-spaces-in-field-values-and-run-stats-timechart-with-new/m-p/217277#M63835 woodcock 2016-06-23T18:48:35Z