Splunk Search
Highlighted

Is it possible to change case of a column name?

Contributor

I would like to change case of column name. Is it possible. My column name changes at run time and is not known at the time of writing the query

Tags (4)
0 Karma
Highlighted

Re: Is it possible to change case of a column name?

Builder

I am guessing you want the column name to be renamed for the result of the search?

If that is the case you can pipe your search to

| rename columnname AS "yournew_name"

if you want to change the name of the field before doing calculations with the new name, you should use the eval command

| eval newname=oldname

0 Karma
Highlighted

Re: Is it possible to change case of a column name?

Contributor

@asimagu Thanks for your reply but it didnt answer my query. I dont know the column name. it is created at run time.
| rename columnname AS "yournewname". i want "yournewname" to be like "COLUMNNAME" - upper case of whatever is present in the column

0 Karma
Highlighted

Re: Is it possible to change case of a column name?

Path Finder

see if this helps you
| foreach * [| eval "uppered<<MATCHSTR>>"='<<MATCHSTR>>' ]

0 Karma
Highlighted

Re: Is it possible to change case of a column name?

Path Finder

That's a way to get the dynamic column name thing solved.

0 Karma
Highlighted

Re: Is it possible to change case of a column name?

SplunkTrust
SplunkTrust

If you want ALL fieldnames to be upper case, then do this at the end...

| streamstats count as recno
| untable recno fieldname fieldvalue
| eval fieldname = upper(fieldname)
| xyseries recno fieldname fieldvalue
| fields - recno

Be aware that the above code will turn multivalue fields to single value fields as if they had been nomved. The following code will protect an mv field called "foo".

| streamstats count as recno
| eval foo = mvjoin(foo,"!!!!")
| untable recno fieldname fieldvalue
| eval fieldname = upper(fieldname)
| xyseries recno fieldname fieldvalue
| eval FOO = split(FOO,"!!!!")
| fields - recno
0 Karma