https://community.splunk.com/t5/Splunk-Search/rename-data/m-p/223563#M65827 <P>If you're looking to rename/update field values with CPU* format (not only CPU001 but CPU002 as well, give this try</P> <PRE><CODE>Your current search | eval Jenis=replace(Jenis,"(00|_)","") </CODE></PRE> Tue, 21 Jun 2016 18:10:06 GMT somesoni2 2016-06-21T18:10:06Z https://community.splunk.com/t5/Splunk-Search/rename-data/m-p/223560#M65824 <P>I want to rename CPU001 to CPU1, CPU_ALL to CPUALL, is it possible?<span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1499i1C10B4048675449C/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 21 Jun 2016 08:15:38 GMT https://community.splunk.com/t5/Splunk-Search/rename-data/m-p/223560#M65824 haziqwebs 2016-06-21T08:15:38Z https://community.splunk.com/t5/Splunk-Search/rename-data/m-p/223561#M65825 <P>Hi,</P> <P>Yes, just put this at the end:</P> <PRE><CODE>| eval Jenis = case (Jenis="CPU001","CPU1",Jenis="CPU_ALL","CPUALL") </CODE></PRE> <P>Hope i help you</P> Tue, 21 Jun 2016 13:17:46 GMT https://community.splunk.com/t5/Splunk-Search/rename-data/m-p/223561#M65825 jmallorquin 2016-06-21T13:17:46Z https://community.splunk.com/t5/Splunk-Search/rename-data/m-p/223562#M65826 <P>Like this:</P> <PRE><CODE>... | replace "CPU001" WITH "CPU1" "CPU_ALL" WITH "CPUALL" IN Jenis </CODE></PRE> Tue, 21 Jun 2016 14:05:12 GMT https://community.splunk.com/t5/Splunk-Search/rename-data/m-p/223562#M65826 woodcock 2016-06-21T14:05:12Z https://community.splunk.com/t5/Splunk-Search/rename-data/m-p/223563#M65827 <P>If you're looking to rename/update field values with CPU* format (not only CPU001 but CPU002 as well, give this try</P> <PRE><CODE>Your current search | eval Jenis=replace(Jenis,"(00|_)","") </CODE></PRE> Tue, 21 Jun 2016 18:10:06 GMT https://community.splunk.com/t5/Splunk-Search/rename-data/m-p/223563#M65827 somesoni2 2016-06-21T18:10:06Z