Splunk Search

How to rename columns in a chart that cam from nested json?

thisissplunk
Builder

I have a nested json element that gives back up to 8 field names. I table them like:

 

| table "Config.DiskBrandSize.*" 

 

Which has child elements like:

 

Barracuda: 100gb
Seagate: 50gb
Sandisk: 150gb

 

 I then sum them up:

 

| chart sum("Config.DiskBrandSize.*") 

 

and I get a table with columns like "sum(Config.DiskBrandSize{}.Sandisk)".

But I want to rename that to just something like "SandiskTotal" which is created from the column name + "Total", NOT do manual renames. I can't figure out how to do this with a foreach either.

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I know you said no manual renames, but the rename command is the one to use.   Like this:

| rename "Config.DiskBrandSize.*" as *Total

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I know you said no manual renames, but the rename command is the one to use.   Like this:

| rename "Config.DiskBrandSize.*" as *Total

 

---
If this reply helps you, an upvote would be appreciated.
0 Karma

thisissplunk
Builder

Thanks, I didn't use rename but I used the same concept in the stats and chart commands.

0 Karma