Method to rename field to value of another field

[dstaulcu]

I would like to be able to rename a field to the value associated with another specified field. Can anyone think of a way to do this?

[acharlieh · Accepted solution]

alacer gave a talk at this year's .conf titled "Using Lesser Known Commands in Splunk Search Processing Language (SPL)"

Among the really good nuggets in there, he talks about how you could use eval to dynamically make fields based on values of other fields, so if the field you want to rename is valuefield, and you want to create a new field based on the value of otherfield you could do:

.... | eval {otherfield}=valuefield

In the slides he also links to this related answer that may be helpful as well

[vasanthmss]

Cool !!!

[dstaulcu]

Awesome. This worked for my particular use case!

[vasanthmss]

try this,

your search..... | rename yourfield1 as [subsearch ... | eval fieldname="\"get a unique string to rename\"" | return $fieldname]

sample search,

|stats count| eval field1="my value" | rename field1 as [|stats count | eval str="\"My Field 1\""|return $str]

[dstaulcu]

Wow.. this looks cool too! This is an indirect method to accomplish my use case it's good to know it could be accomplished in that way too!

Thanks all!

[sanhema]

How to configure the same in props.conf. Both of my fields are not in subsequent ..there are in different place.

Thanks.