Remove Wildcard from Field Name

[makarand13]

I have some ticketing data being imported into Splunk for analysis. There are a couple of field names with an asterix (*) in them.

Example - Priority*

How do I rename such a field to just "Priority", or a non-wildcard string? Thanks !!

[harishalipaka]

| transpose 
| replace "Priority*" with Priority 
| transpose header_field=column

[elliotproebstel]

To build on this and make it rename all field names containing wildcards at once:

| transpose 
| rex field=column mode=sed "s/\*//g" 
| transpose header_field=column 
| fields - column

[niketn]

@makarand13 can you post raw events where such wildcard based fields exist?

The following could be a fix during search time however, you should rather fix it while indexing using SEDCMD

<yourBaseSearch>
|  eval priority='Priority*'
|  fields - Priority*

[elliotproebstel]

Upvoting this especially to reinforce that the best solution is to fix while indexing!