rename column name

[simo]

hi 

I have a column with the following name

transactionId: N/A

the value after :  it can take on more values 

transactionId: start

how can I rename it so that it always takes the value transactionId ?

Thanks for your help 🙂

Simone

[ITWhisperer]

Do you mean something like this?

| makeresults
| eval transactionid="start"
| eval {transactionid}=transactionid

[simo]

hi @ITWhisperer 

start is the name that the column takes, the field can be called

"transactionId: N/A" OR "transactionId: start" 

I would like to rename it "transactionId" depending on the name it takes

simone

[ITWhisperer]

| makeresults 
| eval transactionid=split("transactionid: start,transactionid: N/A",",")
| mvexpand transactionid
| streamstats count as row 
| eval {transactionid}=mvindex(split("AB",""),row%2)
| fields - transactionid _time row
| foreach "transactionid: *"
    [| eval transactionid=coalesce(transactionid,'<<FIELD>>')]

You can't have more than one field with the same name but you can eval a field more than once