Splunk Search

Dynamically change field name labels

cmak
Contributor

I have many fields that end with the regular expression _rate.
Ex:
Compile_rate
Typing_rate

I can get all my rates with this query
index="a" |stats dc() as * |transpose | regex column=^._rate.*$ |

However, I would like to rename these results in a new column, with the '_rate' removed.
So i would like to have Compile, Typing etc

How can I do this?

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You're looking for this:

... | rename *_rate as *

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You're looking for this:

... | rename *_rate as *

cmak
Contributor

Yup, that works. Sorry, I realized I was not changing my table fields. Quite silly 😞

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

This works for me:

... | rename *_rate as "* rate"

Here's a full example:

| gentimes start=-1 increment=5m | eval foo_rate = 1 | eval bar_rate = 2 | rename *_rate as "* rate"
0 Karma

cmak
Contributor

What if I wanted to do something like
rename Compile_rate as "Compile rate"

rename rate as " rate"
does not yield me any results

0 Karma

cmak
Contributor

Great, this worked 🙂

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...