- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
msarkaus
Explorer
09-17-2022
05:07 AM
Hello,
I'm fairly new to Splunk and I'm hoping someone could help me rename the API names in my Dashboard. I have several names associated with urlPthTxt.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
09-17-2022
05:15 AM
"renaming" refers to changing the identifier of a field, as you did by changing "urlPNthTxt" to "API". What you seek, however, is a change in the values stored in a field. That requires an eval, replace, or sed (perhaps other commands that escape me ATM).
| replace "/V1/" with "" in API
or
| rex field=API mode=sed "s;/V1/;;"
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
msarkaus
Explorer
09-17-2022
05:40 AM
Thank you, both suggestions worked..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
09-17-2022
05:15 AM
"renaming" refers to changing the identifier of a field, as you did by changing "urlPNthTxt" to "API". What you seek, however, is a change in the values stored in a field. That requires an eval, replace, or sed (perhaps other commands that escape me ATM).
| replace "/V1/" with "" in API
or
| rex field=API mode=sed "s;/V1/;;"
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
