How do I create a new field?

[or1515]

Hey splunkers,

How do I create a new field in splunk?

If I have a windows security log with "User" field and I want to call it and use it as "Account".

I tried we Eval but didn't succeed. 

Thanks.

[richgalloway]

There are several ways to create a field, but eval perhaps is the most common.  Please share your attempt so we can help determine what went wrong.

[or1515]

This is the query:

index="net" sourcetype="Okta" eventType="user.account.privilege.grant"
In the log there is field called "Username".
I want to change it to "User".

You ask why? 
I want to write a correlation rule from 2 different indexes and I want to use the same field for both.
Im waiting for an answer here: https://community.splunk.com/t5/Security/Correlation-rule/m-p/566419#M15581

[isoutamo]

Hi
try "rename Username as User"
r. Ismo