How to rename a dynamic header name?

[Uwbspeicher]

Hi, I need to format a search very specifically so that the client's automation receives a report correctly. All I need is to rename a field name to a value with strftime(now(), "%Y%m%d") in it, but the rename command doesn't seem to support that. Any way that I can make this value my header without altering the data?

[sbbadri · Accepted solution]

@Uwbspeicher

please try this,

| eval today=strftime(now(),"%Y%m%d") | eval {today}=yourfieldheadername | fields - today yourfieldheadername

[Uwbspeicher]

That worked, thank you! Never seen the curly braces before; those are helpful.

[niketn]

@Uwbspeicher, can you share your existing query? The rename/re-format might be possible before the final transforming command.