Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to rename column and row labels after using tr...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
I am having no luck renaming "column" and "row1, row2,..." successfully to "fields" and "event 1, event 2, event3, ...."
I can | rename column as fields, but no luck with the rows.
Please advise how to rename the column to fields and rows to events, row1>event1.
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For row values, you have to use replace not rename. Try this replace "column 1" WITH "somevalue" IN column
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The right way to do this is to use the header_field option for the transpose command
| transpose header_field=Key
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For row values, you have to use replace not rename. Try this replace "column 1" WITH "somevalue" IN column
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for the reply. I may have a miscommunication. I actually just want to rename the column and row labels, not necessarily use Splunk fields.
....| transpose | rename column as Details, "row 1" as 1
so I would like to auto-rename the row 1, row 2, row 3, to just be 1, 2, 3 (dropping the word row)
Is that possible?
I guess the answer is YES, just needed
| transpose | rename column as Details, row* as *
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You mean like this?
| transpose | rename column AS Details "row "* AS *
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello!
I'm in a similar situation now and this works great but I was wondering if there's a way to individually rename each column? The 'not working' way would look like this:
... | rename row1 AS "Column 1", row2 AS "Scan Logs", row3 AS "etc."Help on this would be greatly appreciated!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need to use:
... | rename "row 1" as "This is Column 1", "row 2" as "This is Column 2", etc
What Is Splunk? Here’s What You Can Do with Splunk
Level Up Your .conf25: Splunk Arcade Comes to Boston
Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...
