How to rename fields only from a certain search (Search1) OR (Search 2)?

[erikschubert]

Hello everyone,

I have a search in the following format:

(index="index1" group=a) OR (index="index2" group=a)....

Later on in the search I want to rename the field host to splunkname, but only those found in events coming from the second "search". The problem ist that both "searches" return events with a field called host.

When I tried this, it didnt work:
(index="index1" group=a) OR (index="index2" group=a| rename host AS splunkname)

How could I solve this?

[gcusello]

Hi @erikschubert,

you have to use eval if:

index="index1" group=a) OR (index="index2" group=a)....
| eval splunkname=if(index=indexB,host, splunkname)

you said that splunkname is equal to host for the second search but you didn't specified what's the value of splunkname for the first search, I supposed that there's this field, anyway take the approach to the problem and the general solution.

Ciao.

Giuseppe