How to reference a Field Name containing "()" without breaking the search or stats?

[leonardr]

I have a field name that contains "(rpm)" and cannot find a way to reference it without it breaking a search or stats. What can I do to escape or otherwise reference the field?

Bob

[woodcock]

You can enclose field names within dollar signs like this:

... | eval xyz_rpm = $xyz (rpm)$

[somesoni2]

Within transforming commands (eval, stats, timechart etc) and WHERE command, use the field within single quote 'YourField(ABC)'

For other places (table, fields, search) put it within double quotes.

[lguinn2]

Have you tried the rename command?

... | rename "xyz (rpm)" as xyz_rpm | ...

I know you probably didn't create the field name this way, but FYI:

Field names that are made from the following character set will never require quotation marks and will be properly understood by all Splunk commands:

Upper case letters (A-Z)
Lower case letters (a-z)
Digits (0-9)
Underscore (_)

Field names should begin with a letter.

[masonmorales]

Have you tried single quotes? 'fieldname'

Another option is to use either a field alias (in props.conf or in Splunk Web on the Search Head via Settings -> Fields -> Field alias), or a rename in your search before doing stats, eval, etc.

[masonmorales]

Also, if it's in the sidebar, click on it, select a value (to add it to your search) and see how Splunk references it.

[lguinn2]

Field alias is also available from the GUI: Go to Settings -> Fields -> Field alias