Splunk Search

How to rename many fields one time?

NPR
Path Finder

For example, I have:
field_name0_NPR_pc field_name1_NPR_pc field_name2_NPR_pc ... field_namen_NPR_pc
I want change as this:
field_name0_NPR_pc as name0
field_name1_NPR_pc as name1
field_name2_NPR_pc as name2
...
field_namen_NPR_pc as namen
I've tried this:

...|rename field_name0_NPR_pc as name0|rename field_name1_NPR_pc as name1|...|field_namen_NPR_pc as namen|.. 

But it is very laborious.
How can I do it?

Thanks

Tags (3)
0 Karma
1 Solution

fdi01
Motivator

try like this:

...|rename field_*_NPR_pc as *|.. 

View solution in original post

fdi01
Motivator

try like this:

...|rename field_*_NPR_pc as *|.. 

NPR
Path Finder

very thank.

0 Karma

ngatchasandra
Builder

Hi,

Try with this

  ...|rename field_name*_NPR_pc as name*| table name*

NPR
Path Finder

thank for your approach
but name is no the same.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...