Dashboards & Visualizations

rename column name

simo
Path Finder

hi 

I have a column with the following name

transactionId: N/A

the value after :  it can take on more values 

transactionId: start

how can I rename it so that it always takes the value transactionId ?

Thanks for your help :slightly_smiling_face:

Simone

 

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this?

| makeresults
| eval transactionid="start"
| eval {transactionid}=transactionid
0 Karma

simo
Path Finder

hi @ITWhisperer 

start is the name that the column takes, the field can be called

"transactionId: N/A" OR "transactionId: start" 

I would like to rename it "transactionId" depending on the name it takes

simone

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval transactionid=split("transactionid: start,transactionid: N/A",",")
| mvexpand transactionid
| streamstats count as row 
| eval {transactionid}=mvindex(split("AB",""),row%2)
| fields - transactionid _time row
| foreach "transactionid: *"
    [| eval transactionid=coalesce(transactionid,'<<FIELD>>')]

You can't have more than one field with the same name but you can eval a field more than once

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...