topic Re: Rename columns in Splunk Search

Rename columns

deanamite91 — Wed, 23 Sep 2015 15:00:15 GMT

I have the following search string

index="commercial_performance" "Efficiency Variance *" OR "Intervention Variance *" OR "Entitlement Variance *" | stats sum(Value) AS "Total" by Cat1 | addcoltotals labelfield=Cat1 label="Total (£)"

On my graph the Efficiency Entitlement and Intervention Variance columns say 'Efficiency Variance (\xA3)' when I want them to say 'Efficiency Variance (£)'.

I have tried renaming them but no luck.

Re: Rename columns

gcato — Wed, 23 Sep 2015 21:21:24 GMT

Hi deanamite91,

Just use the "rename" command to rename your column headers.

... | rename "Efficiency Variance (xA3)" AS "Efficiency Variance (£)" ...<and so on>...

Re: Rename columns

deanamite91 — Thu, 24 Sep 2015 08:06:53 GMT

I've tried using rename and it doesn't work.

Re: Rename columns

deanamite91 — Thu, 24 Sep 2015 08:38:20 GMT

The field is Cat1 and the values within it are Efficiency Variance (\xA3), Intervention Variance (\xA3) and Entitlement Variance (\xA3)

Re: Rename columns

gcato — Thu, 24 Sep 2015 22:08:38 GMT

I suggest either the sed or the replace() commands. For example,

... | rex mode=sed "s/xA3/£/g"

  ... | eval Cat1 = replace(Cat1, "xA3", "£")