Splunk Search

How to rename a dynamic header name?

New Member

Hi, I need to format a search very specifically so that the client's automation receives a report correctly. All I need is to rename a field name to a value with strftime(now(), "%Y%m%d") in it, but the rename command doesn't seem to support that. Any way that I can make this value my header without altering the data?

0 Karma
1 Solution

Motivator

@Uwbspeicher

please try this,

| eval today=strftime(now(),"%Y%m%d") | eval {today}=yourfieldheadername | fields - today yourfieldheadername

View solution in original post

0 Karma

Motivator

@Uwbspeicher

please try this,

| eval today=strftime(now(),"%Y%m%d") | eval {today}=yourfieldheadername | fields - today yourfieldheadername

View solution in original post

0 Karma

New Member

That worked, thank you! Never seen the curly braces before; those are helpful.

0 Karma

SplunkTrust
SplunkTrust

@Uwbspeicher, can you share your existing query? The rename/re-format might be possible before the final transforming command.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma