Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- can we use rename command for eventtype
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes? Could you please tell us more about which eventtypes you want to rename how, and we might be able to help you?
UPDATE: So, to get rid of the et_MP_ prefix, you could use rex in sed mode.
... | rex field=eventtype mode=sed "s/et_MP_//"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes? Could you please tell us more about which eventtypes you want to rename how, and we might be able to help you?
UPDATE: So, to get rid of the et_MP_ prefix, you could use rex in sed mode.
... | rex field=eventtype mode=sed "s/et_MP_//"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No problem! Could you please mark my answer as accepted? Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Ayn !! It was very helpful
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Updated my answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yeah sure..
I have eventtypes names like this
1.et_MP_Accepted
2.et_MP_Rejected
Now i have written a query like this..
sourcetype="MPdata" | eval Field=mvfilter(eventtype like "et_MP_%") | top Field
No i am getting my results as
o/p:
1.et_MP_Accepted 30
2.et_MP_Rejected 20
I want to rename these eventtypes as et_MP_Accepted as Accepted and et_MP_Rejected as Rejected in the output...
How can i do that ?? . Please Help !!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
