All Apps and Add-ons

rename clobbers existing field with that name

alexl1
Path Finder

hi, is there a way to rename a splunk field but that if the field name already exists it won't get clobbered?

E.g.
let's say some events have a field called oldfield and some already have a field called newfield

I want oldfield to get renamed but if newfield exists (and I know old field won't exist if it does) then I want that to be newfield

thanks,

Tags (1)
0 Karma
1 Solution

acharlieh
Influencer

Instead of rename, you could use an eval to determine the value, and then just remove the oldfield.

| eval newfield=coalesce(newfield,oldfield) | fields - oldfield

View solution in original post

acharlieh
Influencer

Instead of rename, you could use an eval to determine the value, and then just remove the oldfield.

| eval newfield=coalesce(newfield,oldfield) | fields - oldfield

lmonahan
Path Finder

Outrageous trick!  Very helpful, thank you!  😀

0 Karma

alexl1
Path Finder

thanks! ..

0 Karma

alexl1
Path Finder

(I used to know how to do it but I forgot)

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...