How to rename a field in splunk?

[okinyx]

I am trying to rename a filed in splunk and it does not work. This is for my lab and below is the command string

index=main sourcetype=access_combined_wcookie action=purchase status=200 file="success.do"  JSESSIONID="*" | rename JESESSIONID as "UserSessions"

[niketn · Accepted solution]

Because there is a spelling mistake in fieldname JSESSIONID which is misspelled as JESESSIONID inside the rename command. Please try the following:

index=main sourcetype=access_combined_wcookie action=purchase status=200 file="success.do" JSESSIONID="*" 
| rename JSESSIONID as UserSessions

PS: Your base search has correct fieldname.

[okinyx]

Thank you very much. That worked