Rename a Column When Using Stats Function

[SplunkLunk]

Good morning,

This must be really simple. I have the query:

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" by user|sort -Count

I want to rename the user column to "User". I'm particular and like my words/heading capitalized. I've tried:

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" values(user) as User by User|sort -Count

I get the following error:

Error in 'stats' command: The output field 'User' cannot have the same name as a group-by field.

I've tried some other things as well and no luck. The closest I got was

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" values(user) as User by user|sort -Count

and that created two columns with the same data (user and User). I suppose I could delete the "user" column from the final output. Any suggestions? Thanks.

[gehinger]

You can pipe a table after your stats and then rename your table fields:
base_search | stats count by field1,field2| table field1 field2 count | rename field1 as NewFieldName1

[DalJeanis]

I'm surprised that splunk let you do that last one. At one point the search manual says you CANT use a group by field as one of the stats fields, and gives an example of creating a second field with eval in order to make that work.

KIran331's answer is correct, just use the rename command after the stats command runs. (... Or before, that works as well.)

[kiran331 · Accepted solution]

try this one..

index=[my index] sourcetype=[my sourcetype] event=login_fail|stats count as Count values(event) as Event values(ip) as "IP Address" by user|sort -Count|rename user as User

[SplunkLunk]

Thanks. I figured I'd be able to do it within the stats function. I should have tried rename after sort. Thanks again.