topic Re: How to set all column names to capital letters in Splunk Search

How to set all column names to capital letters

DavidHourani — Fri, 02 Dec 2016 11:07:17 GMT

Hello dear Splunkers,

Any idea how to set column names to uppercase/capital letters?
I'm not talking about all the data in the data set, just the column names. I have a table with 10 column and 10000 events and would like to have the column names in capital letters.
Also I don't want to have to go through 10 renames, I'm looking for an automatic way to set them all to capital letters in case i add extra columns.

Regards,
David

Re: How to set all column names to capital letters

rjthibod — Fri, 02 Dec 2016 11:50:26 GMT

I don't think there is a shortcut to doing this without using rename many times. I do not think you can use fieldformat and foreach directly. There may be some roundabout way using appendpipe to generate a list of new field names and then renaming the old names, but that seems a bit much.

Re: How to set all column names to capital letters

DavidHourani — Fri, 02 Dec 2016 12:38:29 GMT

I was thinking about something with a transpose -> eval upper -> transpose... But it doesnt seem to work with a lot of rows..

Re: How to set all column names to capital letters

rjthibod — Fri, 02 Dec 2016 13:10:29 GMT

Correct, there is a limit on transpose.

Re: How to set all column names to capital letters

acharlieh — Fri, 02 Dec 2016 13:23:18 GMT

I think having a command with explicit renames is honestly your best bet performance wise... Using an eval trick I learned from @alacercogitatus I came up with:

... |  foreach * [eval temp=upper("<<FIELD>>"), {temp}='<<FIELD>>'| fields - "<<FIELD>>" temp ]

However it too seems to scale terribly with lots of results, taking longer than the base search for merely a few thousand results due to the number of executions it has to make versus a single explicit rename command listing all fields