Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- can we use rename command for eventtype
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes? Could you please tell us more about which eventtypes you want to rename how, and we might be able to help you?
UPDATE: So, to get rid of the et_MP_ prefix, you could use rex in sed mode.
... | rex field=eventtype mode=sed "s/et_MP_//"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes? Could you please tell us more about which eventtypes you want to rename how, and we might be able to help you?
UPDATE: So, to get rid of the et_MP_ prefix, you could use rex in sed mode.
... | rex field=eventtype mode=sed "s/et_MP_//"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No problem! Could you please mark my answer as accepted? Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Ayn !! It was very helpful
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Updated my answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yeah sure..
I have eventtypes names like this
1.et_MP_Accepted
2.et_MP_Rejected
Now i have written a query like this..
sourcetype="MPdata" | eval Field=mvfilter(eventtype like "et_MP_%") | top Field
No i am getting my results as
o/p:
1.et_MP_Accepted 30
2.et_MP_Rejected 20
I want to rename these eventtypes as et_MP_Accepted as Accepted and et_MP_Rejected as Rejected in the output...
How can i do that ?? . Please Help !!
Index This | Why did the turkey cross the road?
Enter the Agentic Era with Splunk AI Assistant for SPL 1.4
Feel the Splunk Love: Real Stories from Real Customers
