I wish to rename fields. But not as straightforward as:
rename prefix_* as *
For a field name "prefix_some_field_name", I want to rename as "Some Field Name". This needs regex substitution
For a field name "prefix_sm_shrthnd_txt", I want to rename as "Some Shorthand Text", ofcourse I will define the lookup of "sm_shrthnd_txt" to "Some Shorthand Text", but where? And how do I use that lookup in rename operation?
I have used lookups and regex in field value manipuation, but not field names! Any ideas?
That was my first thought as well. But I have way too many fields to do this manually in each report.
Is there documentation on how to define and use lookups for field renaming? I tried finding in Splunk Docs but couldn't get anywhere. And also regex renaming (like replace _ with space, make first letter capital for each word etc.)