Splunk Search

How to rename all the fields with "s0" at the end of them?

Path Finder

I have this column named as "cloud-look-up_s0" and "cloud-look-up_s1" and so on and so on. so What I want to do is to rename "cloud-look-up-s0" with "cloud-look-up-Today". But here is the thing, I want to name all fields that have "s0" in the end to "Today " and the columns will have a different string attached in the front so the format would be something like:

string1_s0, string1_s1 
string2_s0, string1_s2 
string3_s0, string1_s3 
string4_s0, string1_s4 
Tags (2)
0 Karma
1 Solution

Motivator

Append this to your search | rename *_s0 as *-Today

View solution in original post

Motivator

Append this to your search | rename *_s0 as *-Today

View solution in original post

Communicator

| rename * _s0 as *-Today

edit: forgot code block and it wasn't showing asterix

0 Karma