Splunk Search

Rename a Column When Using Stats Function

SplunkLunk
Path Finder

Good morning,

This must be really simple. I have the query:

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" by user|sort -Count

I want to rename the user column to "User". I'm particular and like my words/heading capitalized. I've tried:

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" values(user) as User by User|sort -Count

I get the following error:

Error in 'stats' command: The output field 'User' cannot have the same name as a group-by field.

I've tried some other things as well and no luck. The closest I got was

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" values(user) as User by user|sort -Count

and that created two columns with the same data (user and User). I suppose I could delete the "user" column from the final output. Any suggestions? Thanks.

Tags (1)
0 Karma
1 Solution

kiran331
Builder

try this one..

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" by user|sort -Count|rename user as User

View solution in original post

gehinger
Engager

You can pipe a table after your stats and then rename your table fields:
base_search | stats count by field1,field2| table field1 field2 count | rename field1 as NewFieldName1

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

I'm surprised that splunk let you do that last one. At one point the search manual says you CANT use a group by field as one of the stats fields, and gives an example of creating a second field with eval in order to make that work.

KIran331's answer is correct, just use the rename command after the stats command runs. (... Or before, that works as well.)

0 Karma

kiran331
Builder

try this one..

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" by user|sort -Count|rename user as User

SplunkLunk
Path Finder

Thanks. I figured I'd be able to do it within the stats function. I should have tried rename after sort. Thanks again.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...