Splunk Search

Dynamically change field name labels

cmak
Contributor

I have many fields that end with the regular expression _rate.
Ex:
Compile_rate
Typing_rate

I can get all my rates with this query
index="a" |stats dc() as * |transpose | regex column=^._rate.*$ |

However, I would like to rename these results in a new column, with the '_rate' removed.
So i would like to have Compile, Typing etc

How can I do this?

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You're looking for this:

... | rename *_rate as *

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You're looking for this:

... | rename *_rate as *

cmak
Contributor

Yup, that works. Sorry, I realized I was not changing my table fields. Quite silly 😞

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

This works for me:

... | rename *_rate as "* rate"

Here's a full example:

| gentimes start=-1 increment=5m | eval foo_rate = 1 | eval bar_rate = 2 | rename *_rate as "* rate"
0 Karma

cmak
Contributor

What if I wanted to do something like
rename Compile_rate as "Compile rate"

rename rate as " rate"
does not yield me any results

0 Karma

cmak
Contributor

Great, this worked 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...