Splunk Search

Rename a column name to yesterday's date in 'dd-mon-yy' format

kabiraj
Path Finder

Hi All,

I want to rename a column name to yesterday's date written in 'dd-mon-yy' format.

Search:

sourcetype=shmapplogs "getMS3SAS ended for - deviceId" | top limit=0 showperc=0 channelId | lookup youview_channels.csv service_id_truncated AS channelId OUTPUT channel_name_letter | streamstats count AS position | fields channel_name_letter position | rename channel_name_letter as Channel position as "Popularity Index"

Result :

Channel           Popularity Index
BT Sport 1             1
BT Sport 2             2
Comedy Central         3
GOLD                     4 

I want to rename the "Popularity Index" to yesterday's date which should be dynamic i.e for today it should be "09-Jun-15".
Results for today should look like :

Channel            09-Jun-15
BT Sport 1          1
BT Sport 2          2
Comedy Central      3
GOLD                  4 

Is it possible? Please reply.

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

You cannot do it with rename but you can clone the old field with an eval trick and then throw away the old field like this:

 ... | eval NewName = now() - (60*60*24) | eval NewName = strftime(NewName , "%ddm%Y") | eval {NewName} = "Popularity Index" | fields - "Popularity Index"

http://answers.splunk.com/answers/186312/method-to-rename-field-to-value-of-another-field.html

View solution in original post

woodcock
Esteemed Legend

You cannot do it with rename but you can clone the old field with an eval trick and then throw away the old field like this:

 ... | eval NewName = now() - (60*60*24) | eval NewName = strftime(NewName , "%ddm%Y") | eval {NewName} = "Popularity Index" | fields - "Popularity Index"

http://answers.splunk.com/answers/186312/method-to-rename-field-to-value-of-another-field.html

kabiraj
Path Finder

Thanks woodcock! The method in the link works perfectly!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...