Splunk Search

Why is rename not working with stats or chart?

prakash007
Builder

I'm not able to rename file names to display in a pie chart...any help would be appreciated...
I tried both ways..

 index=web_server sourcetype=web_access  (file="pr.prod" OR file="cr.crt" OR file="src.jsp")  SESSIONID!="-" | dedup  SESSIONID | stats count by file | rename "pr.prod" AS "Products", "cr.crt" AS "Category", "src.jcp"  AS "Search"

 index=web_server sourcetype=web_access   SESSIONID!="-" | dedup SESSIONID |  stats count(eval( file="pr.prod")) AS Products, count(eval(file="cr.crt")) AS Category, count(eval(file="srchjsp")) AS search | stats count by file 
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The rename command changes the name of a field, not the values of a field. To change values, use the replace command.

index=web_server sourcetype=web_access  (file="pr.prod" OR file="cr.crt" OR file="src.jsp")  SESSIONID!="-" | dedup  SESSIONID | stats count by file | replace "pr.prod" with "Products" in file | replace "cr.crt" with "Category" in file | replace "src.jcp" with "Search" in file

The second method looks to me like it should work.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The rename command changes the name of a field, not the values of a field. To change values, use the replace command.

index=web_server sourcetype=web_access  (file="pr.prod" OR file="cr.crt" OR file="src.jsp")  SESSIONID!="-" | dedup  SESSIONID | stats count by file | replace "pr.prod" with "Products" in file | replace "cr.crt" with "Category" in file | replace "src.jcp" with "Search" in file

The second method looks to me like it should work.

---
If this reply helps you, Karma would be appreciated.

prakash007
Builder

Thankyou...It worked,I have also added count at the end of the search to display the count by file in pie chart...

.......... | replace "src.jcp" with "Search" in file| eval  file_slice = count + "-" + file | fields file_slice, count
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...