Splunk Search

How to rename many fields one time?

NPR
Path Finder

For example, I have:
field_name0_NPR_pc field_name1_NPR_pc field_name2_NPR_pc ... field_namen_NPR_pc
I want change as this:
field_name0_NPR_pc as name0
field_name1_NPR_pc as name1
field_name2_NPR_pc as name2
...
field_namen_NPR_pc as namen
I've tried this:

...|rename field_name0_NPR_pc as name0|rename field_name1_NPR_pc as name1|...|field_namen_NPR_pc as namen|.. 

But it is very laborious.
How can I do it?

Thanks

Tags (3)
0 Karma
1 Solution

fdi01
Motivator

try like this:

...|rename field_*_NPR_pc as *|.. 

View solution in original post

fdi01
Motivator

try like this:

...|rename field_*_NPR_pc as *|.. 

NPR
Path Finder

very thank.

0 Karma

ngatchasandra
Builder

Hi,

Try with this

  ...|rename field_name*_NPR_pc as name*| table name*

NPR
Path Finder

thank for your approach
but name is no the same.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...