Splunk Search

Renaming field name having #

ccflsampa
New Member

How can I rename a field name starting with # in Splunk search tab?
For example: field name I have "#client Name" and I want to rename it as "clientName"

Thanks!

Tags (1)
0 Karma

ccflsampa
New Member

Thank you!
I am able to rename the field name with # (successfully renamed # MHCP Cases to MHCPCases)
but while saving the results to the dashboard I am getting the error (The dataset "RootObject" has no field " MHCP Cases" ). How can I avoid this error?

0 Karma

Shan
Builder

@ ccflsampa : I hope you got your answer. If the above commands helps. Please accept the answer and close the question.

0 Karma

Shan
Builder

yes i accept with @ssadanala1.
I hope you need to rename the field name in spl query right. If yes is your answer.
Then you can use simple rename command and change the field name.

Example :

| makeresults
|eval "#Data" = 1
|eval "#client Name"="study"
|rename #Data as Data, "#client Name" as "client Name"

You can simply use this for renaming your field..
|rename #Data as Data, "#client Name" as "client Name"

0 Karma

ssadanala1
Contributor

Please try this

| makeresults 
|eval "#hello" = "1"|eval "#hola"="2"
|rename #* as *
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...