Splunk Search

How to rename all the fields with "s0" at the end of them?

kiamco
Path Finder

I have this column named as "cloud-look-up_s0" and "cloud-look-up_s1" and so on and so on. so What I want to do is to rename "cloud-look-up-s0" with "cloud-look-up-Today". But here is the thing, I want to name all fields that have "s0" in the end to "Today " and the columns will have a different string attached in the front so the format would be something like:

string1_s0, string1_s1 
string2_s0, string1_s2 
string3_s0, string1_s3 
string4_s0, string1_s4 
Tags (2)
0 Karma
1 Solution

sudosplunk
Motivator

Append this to your search | rename *_s0 as *-Today

View solution in original post

sudosplunk
Motivator

Append this to your search | rename *_s0 as *-Today

anthonymelita
Contributor

| rename * _s0 as *-Today

edit: forgot code block and it wasn't showing asterix

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...