Splunk Search
Highlighted

How to rename multiple field names with certain criteria

Motivator

How do I replace the MB in each field name with GB ??

_time   XXX-XX-MB   XXX-XXX-MB  XXXXXXMB_XX_XXX
1   2017-07-30 11:00    1391.67548628852    1381.60821617188    1274.532780647
2   2017-07-30 12:00    1509.29349191985    1503.65362613860    1373.894662857

So my result would look like this:

_time   XXX-XX-GB   XXX-XXX-GB  XXXXXXGB_XX_XXX
1   2017-07-30 11:00    1391.67548628852    1381.60821617188    1274.532780647
2   2017-07-30 12:00    1509.29349191985    1503.65362613860    1373.894662857

I can already change all the field values with this command and was thinking I could do something similar with the field names.
foreach * [eval <<FIELD>>='<<FIELD>>'/1024] |

Highlighted

Re: How to rename multiple field names with certain criteria

Champion

try this!

(your search)|rename *_mb* as *_gb*|foreach *_gb* [eval <<FIELD>>='<<FIELD>>'/1024]