Splunk Search

How to rename field names using lookups and regex?

shikhanshu
Path Finder

I wish to rename fields. But not as straightforward as:

rename prefix_* as *

For a field name "prefix_some_field_name", I want to rename as "Some Field Name". This needs regex substitution

For a field name "prefix_sm_shrthnd_txt", I want to rename as "Some Shorthand Text", ofcourse I will define the lookup of "sm_shrthnd_txt" to "Some Shorthand Text", but where? And how do I use that lookup in rename operation?

I have used lookups and regex in field value manipuation, but not field names! Any ideas?

ulrich_track
Path Finder

Would it be sufficient for you, if you used the rename command in your search?

E.g. rename prefix_sm_shrthnd_txt AS "Some Shorthand Text"

Unfortunately, this would mean that you would have to rename your complete list in the search field and not use a lookup (depends on the number of entries, you would have here)

0 Karma

shikhanshu
Path Finder

That was my first thought as well. But I have way too many fields to do this manually in each report.

Is there documentation on how to define and use lookups for field renaming? I tried finding in Splunk Docs but couldn't get anywhere. And also regex renaming (like replace _ with space, make first letter capital for each word etc.)

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!