topic Re: How do I rename fields in my Splunk search result set? in Splunk Search

How do I rename fields in my Splunk search result set?

pawnalmighty — Mon, 19 Oct 2015 06:40:00 GMT

index=xxx earliest=-7d@d latest=@d
( sourcetype="FirstSourceType" ResponsePayLoad="*xxx*" ActivityStep="rs" (ResponseStatus!=500 OR ResponseStatus!=400) )
OR
( sourcetype="SecondSourceType" OperationName=CSRequestProcessor.post ActivityStep="rs" ResponseStatus=0)
| eval txn_id=if(transaction_id LIKE "[%]", substr(transaction_id, 2, 36) , transaction_id) | chart sum(Duration) over txn_id by sourcetype

What I get is a table with three columns :

txn_id ..... FirstSourceType .... SecondSourceType

Is it possible to rename FirstSourceType & SecondSourceType to "Total Time Taken" & "Total time taken by zzz" respectively?

I tried rename command but couldn't get it to work:

index=xxx earliest=-7d@d latest=@d
( sourcetype="FirstSourceType" ResponsePayLoad="*xxx*" ActivityStep="rs" (ResponseStatus!=500 OR ResponseStatus!=400) ) | rename sourcetype to "Total Time Taken"
OR
( sourcetype="SecondSourceType" OperationName=CSRequestProcessor.post ActivityStep="rs" ResponseStatus=0)  | rename sourcetype to ""Total time taken by zzz"
| eval txn_id=if(transaction_id LIKE "[%]", substr(transaction_id, 2, 36) , transaction_id) | chart sum(Duration) over txn_id by sourcetype

But I got the error:

Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+

Re: How do I rename fields in my Splunk search result set?

asimagu — Mon, 19 Oct 2015 09:35:22 GMT

you can try eval

eval "Total Time Taken"=sourcetype

and then you will need to get rid of the unwanted fields | fields - sourcetype

Re: How do I rename fields in my Splunk search result set?

fdi01 — Wed, 27 Jan 2016 13:13:54 GMT

try like :

... | rename  FirstSourceType as  "Total Time Taken" , SecondSourceType as "Total time taken by zzz"  |...

you can try like this in your case :

 index=xxx earliest=-7d@d latest=@d
( sourcetype="FirstSourceType" ResponsePayLoad="*xxx*" ActivityStep="rs" (ResponseStatus!=500 OR ResponseStatus!=400) )
OR
( sourcetype="SecondSourceType" OperationName=CSRequestProcessor.post ActivityStep="rs" ResponseStatus=0) 
| eval txn_id=if(transaction_id LIKE "[%]", substr(transaction_id, 2, 36) , transaction_id) | chart sum(Duration) over txn_id by sourcetype |replace  FirstSourceType with   "Total Time Taken" in sourcetype |replace  SecondSourceType with   "Total time taken by zzz" in sourcetype