Splunk Enterprise Security

How i can rename the field output value in splunk.

hrs2019
Path Finder

how i can rename the field output value in splunk.

below is the screen short
i want to RENAME

PPN | V0.2019 |2456 TO PPN | v0.1342 |2546

want to do changes in project update field and number of users side field for PPN client.

alt text

0 Karma

dindu
Contributor

Hi,
You could use the eval command to achieve this.
I assume the values are hardcoded as in the question.

Please try and let us know.

 |your_search
 |eval  "Project Update"=if(Clients="PPN","v0.1342",'Project Update')
 |eval  "Number of users"=if(Clients="PPN","2546",'Number of users')
 |table Clients,"Project Update","Number of users"
0 Karma

hrs2019
Path Finder

Thanks @dindu no it is not hardcoded it is changing but i want to rename this time by manual.

0 Karma

to4kawa
Ultra Champion

what's v0.1342?
are you goiog to copy client PPN's values to CNB?

...
| eval "Project Update"=if(Client="CNB","v0.1342",'Project Update')
| eval "Number of users"=if(Client="CNB",2546,'Number of user')

If you want to change the field values, that's it.

0 Karma

hrs2019
Path Finder

sorry @to4kawa i have corrected the question it is PPN not CNB and v0.1342 is kind of version (updates)

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...