Splunk Search

Why is SPL receiving error?

BongoNations
Explorer

Hi I have this SPL query but getting this error?

Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+.

Any ideas why or how to resolve this please?

| tstats count where index=os earliest=-7d latest=-3h by host, _time span=3h
| stats median(count) as median by host
| join host [| tstats count where index=os earliest=-3h by host]
| eval percentage_diff=((count/median)*100)-100
| where percentage_diff<-5 OR percentage_diff>5
| sort percentage_diff
| rename median as “Median Event Count Past Week”, count as “Event Count of Events Past 3 Hours”, percentage_diff as “Percentage Difference”

 

Labels (2)
0 Karma
1 Solution

BongoNations
Explorer

Its ok I saw the problem was due to the character " I copied and pasted from cherry tree into Splunk and Splunk did not like that.. I had to type the " again

View solution in original post

0 Karma

BongoNations
Explorer

Its ok I saw the problem was due to the character " I copied and pasted from cherry tree into Splunk and Splunk did not like that.. I had to type the " again

0 Karma
Get Updates on the Splunk Community!

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...