Splunk Search

How to rename many fields one time?

NPR
Path Finder

For example, I have:
field_name0_NPR_pc field_name1_NPR_pc field_name2_NPR_pc ... field_namen_NPR_pc
I want change as this:
field_name0_NPR_pc as name0
field_name1_NPR_pc as name1
field_name2_NPR_pc as name2
...
field_namen_NPR_pc as namen
I've tried this:

...|rename field_name0_NPR_pc as name0|rename field_name1_NPR_pc as name1|...|field_namen_NPR_pc as namen|.. 

But it is very laborious.
How can I do it?

Thanks

Tags (3)
0 Karma
1 Solution

fdi01
Motivator

try like this:

...|rename field_*_NPR_pc as *|.. 

View solution in original post

fdi01
Motivator

try like this:

...|rename field_*_NPR_pc as *|.. 

NPR
Path Finder

very thank.

0 Karma

ngatchasandra
Builder

Hi,

Try with this

  ...|rename field_name*_NPR_pc as name*| table name*

NPR
Path Finder

thank for your approach
but name is no the same.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...