Splunk Search

Rename a column name to yesterday's date in 'dd-mon-yy' format

kabiraj
Path Finder

Hi All,

I want to rename a column name to yesterday's date written in 'dd-mon-yy' format.

Search:

sourcetype=shmapplogs "getMS3SAS ended for - deviceId" | top limit=0 showperc=0 channelId | lookup youview_channels.csv service_id_truncated AS channelId OUTPUT channel_name_letter | streamstats count AS position | fields channel_name_letter position | rename channel_name_letter as Channel position as "Popularity Index"

Result :

Channel           Popularity Index
BT Sport 1             1
BT Sport 2             2
Comedy Central         3
GOLD                     4 

I want to rename the "Popularity Index" to yesterday's date which should be dynamic i.e for today it should be "09-Jun-15".
Results for today should look like :

Channel            09-Jun-15
BT Sport 1          1
BT Sport 2          2
Comedy Central      3
GOLD                  4 

Is it possible? Please reply.

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

You cannot do it with rename but you can clone the old field with an eval trick and then throw away the old field like this:

 ... | eval NewName = now() - (60*60*24) | eval NewName = strftime(NewName , "%ddm%Y") | eval {NewName} = "Popularity Index" | fields - "Popularity Index"

http://answers.splunk.com/answers/186312/method-to-rename-field-to-value-of-another-field.html

View solution in original post

woodcock
Esteemed Legend

You cannot do it with rename but you can clone the old field with an eval trick and then throw away the old field like this:

 ... | eval NewName = now() - (60*60*24) | eval NewName = strftime(NewName , "%ddm%Y") | eval {NewName} = "Popularity Index" | fields - "Popularity Index"

http://answers.splunk.com/answers/186312/method-to-rename-field-to-value-of-another-field.html

kabiraj
Path Finder

Thanks woodcock! The method in the link works perfectly!

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...