Splunk Search

Why doesn't my rename work? Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+.

iiooiiooiioo
Explorer

I have this splunk search:

host=app-dev-001 terminating | convert timeformat="%Y-%m-%d" ctime(_time) AS date | sort term_user | rename term_user AS 'Terminated User'

When I run it I get this error:

Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+.

This search works:

host=app-dev-001 terminating | convert timeformat="%Y-%m-%d" ctime(_time) AS date | sort term_user | table term_user

I get results that look like:

alt text

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try rename term_user AS "Terminated User". Splunk has different uses for single and double quotes.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try rename term_user AS "Terminated User". Splunk has different uses for single and double quotes.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!