Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Method to rename field to value of another fie...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would like to be able to rename a field to the value associated with another specified field. Can anyone think of a way to do this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
alacer gave a talk at this year's .conf titled "Using Lesser Known Commands in Splunk Search Processing Language (SPL)"
Among the really good nuggets in there, he talks about how you could use eval to dynamically make fields based on values of other fields, so if the field you want to rename is valuefield, and you want to create a new field based on the value of otherfield you could do:
.... | eval {otherfield}=valuefield
In the slides he also links to this related answer that may be helpful as well
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
alacer gave a talk at this year's .conf titled "Using Lesser Known Commands in Splunk Search Processing Language (SPL)"
Among the really good nuggets in there, he talks about how you could use eval to dynamically make fields based on values of other fields, so if the field you want to rename is valuefield, and you want to create a new field based on the value of otherfield you could do:
.... | eval {otherfield}=valuefield
In the slides he also links to this related answer that may be helpful as well
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Cool !!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Awesome. This worked for my particular use case!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try this,
your search..... | rename yourfield1 as [subsearch ... | eval fieldname="\"get a unique string to rename\"" | return $fieldname]
sample search,
|stats count| eval field1="my value" | rename field1 as [|stats count | eval str="\"My Field 1\""|return $str]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Wow.. this looks cool too! This is an indirect method to accomplish my use case it's good to know it could be accomplished in that way too!
Thanks all!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to configure the same in props.conf. Both of my fields are not in subsequent ..there are in different place.
Thanks.
Fun with Regular Expression - multiples of nine
[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...
What’s New & Next in Splunk SOAR
