Archive
Highlighted

Rename a Column When Using Stats Function

Path Finder

Good morning,

This must be really simple. I have the query:

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" by user|sort -Count

I want to rename the user column to "User". I'm particular and like my words/heading capitalized. I've tried:

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" values(user) as User by User|sort -Count

I get the following error:

Error in 'stats' command: The output field 'User' cannot have the same name as a group-by field.

I've tried some other things as well and no luck. The closest I got was

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" values(user) as User by user|sort -Count

and that created two columns with the same data (user and User). I suppose I could delete the "user" column from the final output. Any suggestions? Thanks.

Tags (1)
0 Karma
Highlighted

Re: Rename a Column When Using Stats Function

Builder

try this one..

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" by user|sort -Count|rename user as User

View solution in original post

Highlighted

Re: Rename a Column When Using Stats Function

Path Finder

Thanks. I figured I'd be able to do it within the stats function. I should have tried rename after sort. Thanks again.

0 Karma
Highlighted

Re: Rename a Column When Using Stats Function

SplunkTrust
SplunkTrust

I'm surprised that splunk let you do that last one. At one point the search manual says you CANT use a group by field as one of the stats fields, and gives an example of creating a second field with eval in order to make that work.

KIran331's answer is correct, just use the rename command after the stats command runs. (... Or before, that works as well.)

0 Karma
Highlighted

Re: Rename a Column When Using Stats Function

Engager

You can pipe a table after your stats and then rename your table fields:
base_search | stats count by field1,field2| table field1 field2 count | rename field1 as NewFieldName1

0 Karma