Hello,
I'm fairly new to Splunk and I'm hoping someone could help me rename the API names in my Dashboard. I have several names associated with urlPthTxt.
"renaming" refers to changing the identifier of a field, as you did by changing "urlPNthTxt" to "API". What you seek, however, is a change in the values stored in a field. That requires an eval, replace, or sed (perhaps other commands that escape me ATM).
| replace "/V1/" with "" in API
or
| rex field=API mode=sed "s;/V1/;;"
Thank you, both suggestions worked..
"renaming" refers to changing the identifier of a field, as you did by changing "urlPNthTxt" to "API". What you seek, however, is a change in the values stored in a field. That requires an eval, replace, or sed (perhaps other commands that escape me ATM).
| replace "/V1/" with "" in API
or
| rex field=API mode=sed "s;/V1/;;"