Splunk Search

Rename a Column When Using Stats Function

SplunkLunk
Path Finder

Good morning,

This must be really simple. I have the query:

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" by user|sort -Count

I want to rename the user column to "User". I'm particular and like my words/heading capitalized. I've tried:

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" values(user) as User by User|sort -Count

I get the following error:

Error in 'stats' command: The output field 'User' cannot have the same name as a group-by field.

I've tried some other things as well and no luck. The closest I got was

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" values(user) as User by user|sort -Count

and that created two columns with the same data (user and User). I suppose I could delete the "user" column from the final output. Any suggestions? Thanks.

Tags (1)
0 Karma
1 Solution

kiran331
Builder

try this one..

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" by user|sort -Count|rename user as User

View solution in original post

gehinger
Engager

You can pipe a table after your stats and then rename your table fields:
base_search | stats count by field1,field2| table field1 field2 count | rename field1 as NewFieldName1

0 Karma

DalJeanis
Legend

I'm surprised that splunk let you do that last one. At one point the search manual says you CANT use a group by field as one of the stats fields, and gives an example of creating a second field with eval in order to make that work.

KIran331's answer is correct, just use the rename command after the stats command runs. (... Or before, that works as well.)

0 Karma

kiran331
Builder

try this one..

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" by user|sort -Count|rename user as User

SplunkLunk
Path Finder

Thanks. I figured I'd be able to do it within the stats function. I should have tried rename after sort. Thanks again.

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...