Splunk Search

Dynamically change field name labels

cmak
Contributor

I have many fields that end with the regular expression _rate.
Ex:
Compile_rate
Typing_rate

I can get all my rates with this query
index="a" |stats dc() as * |transpose | regex column=^._rate.*$ |

However, I would like to rename these results in a new column, with the '_rate' removed.
So i would like to have Compile, Typing etc

How can I do this?

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You're looking for this:

... | rename *_rate as *

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You're looking for this:

... | rename *_rate as *

cmak
Contributor

Yup, that works. Sorry, I realized I was not changing my table fields. Quite silly 😞

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

This works for me:

... | rename *_rate as "* rate"

Here's a full example:

| gentimes start=-1 increment=5m | eval foo_rate = 1 | eval bar_rate = 2 | rename *_rate as "* rate"
0 Karma

cmak
Contributor

What if I wanted to do something like
rename Compile_rate as "Compile rate"

rename rate as " rate"
does not yield me any results

0 Karma

cmak
Contributor

Great, this worked 🙂

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...