Splunk Search

Remove Wildcard from Field Name

makarand13
New Member

I have some ticketing data being imported into Splunk for analysis. There are a couple of field names with an asterix (*) in them.

Example - Priority*

How do I rename such a field to just "Priority", or a non-wildcard string? Thanks !!

Tags (1)
0 Karma

harishalipaka
Motivator
| transpose 
| replace "Priority*" with Priority 
| transpose header_field=column
Thanks
Harish
0 Karma

elliotproebstel
Champion

To build on this and make it rename all field names containing wildcards at once:

| transpose 
| rex field=column mode=sed "s/\*//g" 
| transpose header_field=column 
| fields - column
0 Karma

niketn
Legend

@makarand13 can you post raw events where such wildcard based fields exist?

The following could be a fix during search time however, you should rather fix it while indexing using SEDCMD

<yourBaseSearch>
|  eval priority='Priority*'
|  fields - Priority*
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

elliotproebstel
Champion

Upvoting this especially to reinforce that the best solution is to fix while indexing!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...