How can I rename a field name starting with # in Splunk search tab?
For example: field name I have "#client Name" and I want to rename it as "clientName"
Thanks!
Thank you!
I am able to rename the field name with # (successfully renamed # MHCP Cases to MHCPCases)
but while saving the results to the dashboard I am getting the error (The dataset "RootObject" has no field " MHCP Cases" ). How can I avoid this error?
@ ccflsampa : I hope you got your answer. If the above commands helps. Please accept the answer and close the question.
yes i accept with @ssadanala1.
I hope you need to rename the field name in spl query right. If yes is your answer.
Then you can use simple rename command and change the field name.
Example :
| makeresults
|eval "#Data" = 1
|eval "#client Name"="study"
|rename #Data as Data, "#client Name" as "client Name"
You can simply use this for renaming your field..
|rename #Data as Data, "#client Name" as "client Name"
Please try this
| makeresults
|eval "#hello" = "1"|eval "#hola"="2"
|rename #* as *