Splunk Search

How do I rename fields in my Splunk search result set?

pawnalmighty
Engager
index=xxx earliest=-7d@d latest=@d
( sourcetype="FirstSourceType" ResponsePayLoad="*xxx*" ActivityStep="rs" (ResponseStatus!=500 OR ResponseStatus!=400) )
OR
( sourcetype="SecondSourceType" OperationName=CSRequestProcessor.post ActivityStep="rs" ResponseStatus=0)
| eval txn_id=if(transaction_id LIKE "[%]", substr(transaction_id, 2, 36) , transaction_id) | chart sum(Duration) over txn_id by sourcetype

What I get is a table with three columns :

txn_id ..... FirstSourceType .... SecondSourceType

Is it possible to rename FirstSourceType & SecondSourceType to "Total Time Taken" & "Total time taken by zzz" respectively?

I tried rename command but couldn't get it to work:

index=xxx earliest=-7d@d latest=@d
( sourcetype="FirstSourceType" ResponsePayLoad="*xxx*" ActivityStep="rs" (ResponseStatus!=500 OR ResponseStatus!=400) ) | rename sourcetype to "Total Time Taken"
OR
( sourcetype="SecondSourceType" OperationName=CSRequestProcessor.post ActivityStep="rs" ResponseStatus=0)  | rename sourcetype to ""Total time taken by zzz"
| eval txn_id=if(transaction_id LIKE "[%]", substr(transaction_id, 2, 36) , transaction_id) | chart sum(Duration) over txn_id by sourcetype

But I got the error:

Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+
0 Karma

fdi01
Motivator

try like :

... | rename  FirstSourceType as  "Total Time Taken" , SecondSourceType as "Total time taken by zzz"  |...

you can try like this in your case :

 index=xxx earliest=-7d@d latest=@d
( sourcetype="FirstSourceType" ResponsePayLoad="*xxx*" ActivityStep="rs" (ResponseStatus!=500 OR ResponseStatus!=400) )
OR
( sourcetype="SecondSourceType" OperationName=CSRequestProcessor.post ActivityStep="rs" ResponseStatus=0) 
| eval txn_id=if(transaction_id LIKE "[%]", substr(transaction_id, 2, 36) , transaction_id) | chart sum(Duration) over txn_id by sourcetype |replace  FirstSourceType with   "Total Time Taken" in sourcetype |replace  SecondSourceType with   "Total time taken by zzz" in sourcetype 
0 Karma

asimagu
Builder

you can try eval

eval "Total Time Taken"=sourcetype

and then you will need to get rid of the unwanted fields | fields - sourcetype

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...