All Apps and Add-ons

How to add a space when renaming a field?

p1stolero
Explorer

I have a search using Timewrap that compares today against last week for the same week day. I'm having issues with renaming the field "1week_before" so it displays as "Last Tuesday". The search fails with

Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+

any time I try adding a space so the closest I've been able to get is "Last_Tuesday". Is there a way to do this?

earliest="-w@w" latest="+w@w" index="_internal" sourcetype="scheduler" 
| timechart span=10m count 
| timewrap w 
| where strftime(_time,"%A") == strftime(now(), "%A")
| rename latest_week as Today 
| rename 1week_before as [| stats count | eval tmp=strftime(now(), "%A") | eval str="Last_".tmp | return $str]
0 Karma
1 Solution

somesoni2
Revered Legend

There are multiple options

 earliest="-w@w" latest="+w@w" index="_internal" sourcetype="scheduler" 
 | timechart span=10m count 
 | timewrap w 
 | where strftime(_time,"%A") == strftime(now(), "%A")
 | rename latest_week as Today
 | rename 1week_before as [| stats count | eval tmp=strftime(now(), "%A") | eval str="\"Last ".tmp."\"" | return $str]

OR

earliest="-w@w" latest="+w@w" index="_internal" sourcetype="scheduler" 
     | timechart span=10m count 
     | timewrap w 
     | where strftime(_time,"%A") == strftime(now(), "%A") 
     | rename latest_week as Today
     | eval t=strftime(_time,"%A")
    | eval "Last {t}"='1week_before' | fields - 1week_before,t

View solution in original post

somesoni2
Revered Legend

There are multiple options

 earliest="-w@w" latest="+w@w" index="_internal" sourcetype="scheduler" 
 | timechart span=10m count 
 | timewrap w 
 | where strftime(_time,"%A") == strftime(now(), "%A")
 | rename latest_week as Today
 | rename 1week_before as [| stats count | eval tmp=strftime(now(), "%A") | eval str="\"Last ".tmp."\"" | return $str]

OR

earliest="-w@w" latest="+w@w" index="_internal" sourcetype="scheduler" 
     | timechart span=10m count 
     | timewrap w 
     | where strftime(_time,"%A") == strftime(now(), "%A") 
     | rename latest_week as Today
     | eval t=strftime(_time,"%A")
    | eval "Last {t}"='1week_before' | fields - 1week_before,t

p1stolero
Explorer

Both of your solutions worked perfectly, thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...