How to use regex on field names?

[tamakg]

For example.

Is there any way to convert this:

into this?

Don't care about the numbers but the value of the second column (new) is a substr of the previous headers. Of course there are many other different "Disks".

[somesoni2 · Accepted solution]

Try like this

your current search giving table in first screenshot
| untable _time fieldname fieldval
| eval fieldname=replace(fieldname,"^(.+_)(Avg_.+)","\2") 
| xyseries _time fieldname fieldval

If above works for you, look at definition of untable/xyseries command here, to understand the usage better:
http://docs.splunk.com/Documentation/SplunkLight/7.1.2/References/Listofsearchcommands

[tamakg]

Almost there. Missing the "removed field prefix" as a new column value.

[somesoni2]

I didn't understand. What are you getting now and what's expected?

[jodyfsu]

If you can provide a sample event we can probably figure this out.

[tamakg]

Here is the sample: https://1drv.ms/u/s!AsmV0Jvla5SrgW-CydStfrht3ep6

[jodyfsu]

| rex field=PhysicalDisk_0_C_Avg__Disk_Bytes_Read "(?<DRIVE>\w+\_\d\_\w)\_(?<AVDBR>.[^\s]+)"

[jodyfsu]

See if that works.

[tamakg]

Nope. New fields are empty...