Splunk Search

How to rename field with * inside like: Service*

Explorer

Hi

I need to rename a field name (from lookup csv) with special character inside, like:
Service*
Status+

the problem is the: *

inputlookup file.csv | rename "Service*" as service

... does not work. how can i tell splunk to ignore the * as "wildcard"?

thanks

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust
| stats count
| rename count as "Status*"
| eval status='Status*'
| fields status

Hi, this is sample query.

| inputlookup file.csv 
| eval  service='Service*'
| fields - Service*

How about this?

View solution in original post

Communicator

Can you please try the below.

inputlookup file.csv | rename 'Service*' as service

Instead of using '' please use '

0 Karma

Explorer

thank you
| rename 'Service*' as service

does not work.

the solution at the end (thanks to to4kawa) is:

|inputlookup report.csv 
 | rename count as "Status*"
 | eval status='Status*'
0 Karma

SplunkTrust
SplunkTrust
| stats count
| rename count as "Status*"
| eval status='Status*'
| fields status

Hi, this is sample query.

| inputlookup file.csv 
| eval  service='Service*'
| fields - Service*

How about this?

View solution in original post

Explorer

thank you so much to4kawa!

this helps:

|inputlookup report.csv 
 | rename count as "Status*"
 | eval status='Status*'

have a good day and thanks

0 Karma

Explorer

Hi

at the end, this works fine:

|inputlookup report.csv 
 | rename count as "Status*"
 | eval status='Status*'

thank you so much

0 Karma

SplunkTrust
SplunkTrust

your welcome, Happy Splunking.

0 Karma

Path Finder

If you just need to change the column name, look at installing the Lookup Editor https://splunkbase.splunk.com/app/1724/. If the lookup is larger than 10 mb and you don't need the field names, I would just re-upload the lookup with the fields you want.

0 Karma

Explorer

thank you - i can just upload the report as "user" - in settings/lookups - therefore not able to rename column during import (like when splunk is locally installed).

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!