Splunk Search

Method to rename field to value of another field

dstaulcu
Builder

I would like to be able to rename a field to the value associated with another specified field. Can anyone think of a way to do this?

Tags (2)
1 Solution

acharlieh
Influencer

alacer gave a talk at this year's .conf titled "Using Lesser Known Commands in Splunk Search Processing Language (SPL)"

Among the really good nuggets in there, he talks about how you could use eval to dynamically make fields based on values of other fields, so if the field you want to rename is valuefield, and you want to create a new field based on the value of otherfield you could do:

.... | eval {otherfield}=valuefield

In the slides he also links to this related answer that may be helpful as well

View solution in original post

acharlieh
Influencer

alacer gave a talk at this year's .conf titled "Using Lesser Known Commands in Splunk Search Processing Language (SPL)"

Among the really good nuggets in there, he talks about how you could use eval to dynamically make fields based on values of other fields, so if the field you want to rename is valuefield, and you want to create a new field based on the value of otherfield you could do:

.... | eval {otherfield}=valuefield

In the slides he also links to this related answer that may be helpful as well

vasanthmss
Motivator

Cool !!!

V
0 Karma

dstaulcu
Builder

Awesome. This worked for my particular use case!

0 Karma

vasanthmss
Motivator

try this,

your search..... | rename yourfield1 as [subsearch ... | eval fieldname="\"get a unique string to rename\"" | return $fieldname]

sample search,

|stats count| eval field1="my value" | rename field1 as [|stats count | eval str="\"My Field 1\""|return $str]
V

dstaulcu
Builder

Wow.. this looks cool too! This is an indirect method to accomplish my use case it's good to know it could be accomplished in that way too!

Thanks all!

0 Karma

sanhema
New Member

How to configure the same in props.conf. Both of my fields are not in subsequent ..there are in different place.

Thanks.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...