Splunk Search

How to rename a dynamic header name?

Uwbspeicher
New Member

Hi, I need to format a search very specifically so that the client's automation receives a report correctly. All I need is to rename a field name to a value with strftime(now(), "%Y%m%d") in it, but the rename command doesn't seem to support that. Any way that I can make this value my header without altering the data?

0 Karma
1 Solution

sbbadri
Motivator

@Uwbspeicher

please try this,

| eval today=strftime(now(),"%Y%m%d") | eval {today}=yourfieldheadername | fields - today yourfieldheadername

View solution in original post

0 Karma

sbbadri
Motivator

@Uwbspeicher

please try this,

| eval today=strftime(now(),"%Y%m%d") | eval {today}=yourfieldheadername | fields - today yourfieldheadername

0 Karma

Uwbspeicher
New Member

That worked, thank you! Never seen the curly braces before; those are helpful.

0 Karma

niketn
Legend

@Uwbspeicher, can you share your existing query? The rename/re-format might be possible before the final transforming command.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...