All Apps and Add-ons

Skylight app for Splunk - Rename syntax error?

eliasit
Path Finder

Hello Splunkers,
I am getting an error on the built in dashboards for the Skylight app. The error is
"Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+."
But the syntax is correct. The dashboards use a search macro that I have expanded and made bold in the example below.
My guess was that the field "result._time" did not exist but I get the same error (bad syntax) no matter what field I use. Rename is use by other dashboards I have and it works on those.

Am I missing something or is this an issue with the app?

Here is an example search:
| inputlookup triggered_alerts
| rename result._time AS result_time,
| eval earliest_time="$earliest$"
| eval earliest_cur=if(earliest_time="0", "-10y@y", "$earliest$")
| eval earliest=round(relative_time(now(), earliest_cur))
| eval latest_time="$latest$"
| eval latest_cur=if(latest_time="now" OR latest_time="", "-0h@h", "$latest$")
| eval latest=round(relative_time(now(), latest_cur))
| where (result_time>=earliest AND result_time<=latest)

| search severity=*
| stats sparkline count by result.ruleName, result.Source
| sort - count | rename sparkline AS Sparkline, count AS "Total Count"

Thanks for reading,

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...