Splunk Search

How to rename a field name with curly braces by using Field Alias ?

erwanlebaron
Engager

Hi

 

I have several search where I performed renaming. Some of them are done on fied which looks like

  • xxx.yyy{}.aaa
  • xxx.yyy{}.bbb
  • zzz{}.ccc

In the search I do

| rename xxx.yyy{}.aaa as newname1,      xxx.yyy{}.bbb as newname2,     zzz{}.ccc as newname3

I tried to implement it with field alias configuration but it's doesn't work

 

Is it possible ?
I don't find any documentation about this specification

 

PS : my field alias works properly without curly braces

Labels (1)
0 Karma
1 Solution

andrew_nelson
Communicator

You can create the Field Alias through the UI using Settings > Fields > Field aliases. 
The format is old{}.field = newField

If you'd prefer to do it via conf file, the format requires quotes:
FIELDALIAS-<alias_name> = "old{}.field" as newField

View solution in original post

0 Karma

erwanlebaron
Engager

Hi @andrew_nelson 

 

Thanks for the answers. It works now.

It was what I've configured.

I just don't understand why alias without {} has applied instantly and those {} was not visible last week. Now I can see all my alias !

 

Have a nice day

0 Karma

andrew_nelson
Communicator

You can create the Field Alias through the UI using Settings > Fields > Field aliases. 
The format is old{}.field = newField

If you'd prefer to do it via conf file, the format requires quotes:
FIELDALIAS-<alias_name> = "old{}.field" as newField

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...