How to rename Splunk column names?

[nibinabr]

Hi,

I have a query that evaluates the value of a variable like this

*...|eval var1= var2*10|....*

where var1 and var2 are variables.

Now I need to rename the column header by doing something like this

*rename column_name as "Number ".var1." is good"* .

But the output I see is *"Number ".var1." is good"* and var1 is not getting replaced by the value. What is the right way of doing this ?

Any help will be appreciated.

[martin_mueller · Accepted solution]

rename can't access column values. Try this:

... | eval Number {var1} is good = column_name | fields - column_name

[sukansingh]

what if variable is holding the column_name and then I want to sort that column.

 for example

my_search | eval date="2023-02-02" | sort  - $date

is it possible to sort by column name which is dynamically generated So i won't know the exact name But variable holds the column name So I can just use sort - $Variable?

[bowesmana]

Please post this as a new question rather than asking a different variant of another question on an 8 year old answer question. It will get more attention.

[nibinabr]

I really appreciate you sharing this example. It is bit confusing that it doesn't work for me when I have the value of var1 being calculated just after my query. When I moved this calculation just before the eval Number {var1} is good = column_name | fields - column_name, it worked for me.

[martin_mueller]

Well, it can't use values from the future...

[nibinabr]

I mean
stats.....|eval var1=var2*10|....|....|......|....|eval Number {var1} is good = column_name | fields - column_name
didnot work for me.

It worked when I changed the above to
stats.....|....|....|......|....|eval var1=var2*10|eval Number {var1} is good = column_name | fields - column_name

[martin_mueller]

Try running this dummy example:

| stats count | eval var1="42 43 44" | makemv var1 | mvexpand var1 | eval column_name = "foo" | eval Number {var1} is good = column_name | fields - column_name

[nibinabr]

Thanks @martin_muller for the quick reply. I tried your solution and now the column in the output now changed to "Number is good". It is not printing the value of var1 between "Number" and "is".