I have many fields that end with the regular expression _rate.
Ex:
Compile_rate
Typing_rate
I can get all my rates with this query
index="a" |stats dc() as * |transpose | regex column=^._rate.*$ |
However, I would like to rename these results in a new column, with the '_rate' removed.
So i would like to have Compile, Typing etc
How can I do this?
You're looking for this:
... | rename *_rate as *
Yup, that works. Sorry, I realized I was not changing my table fields. Quite silly 😞
This works for me:
... | rename *_rate as "* rate"
Here's a full example:
| gentimes start=-1 increment=5m | eval foo_rate = 1 | eval bar_rate = 2 | rename *_rate as "* rate"
What if I wanted to do something like
rename Compile_rate as "Compile rate"
rename rate as " rate"
does not yield me any results
Great, this worked 🙂