Splunk Search

Why isn't the rename command not renaming fields?

payton_tayvion
Path Finder

I'm currently creating a list that lists top 10 technologies and I'm trying to rename "Red" as "Red Hat" using the rename command.
Here's the query:

| tstats summariesonly=f dc(Vulnerabilities.signature) as count from datamodel="Vulnerabilitiesv3" where (nodename="Vulnerabilities" (Vulnerabilities.severity!=informational Vulnerabilities.severity!=unknown) Vulnerabilities.dest_bunit IN (*) Vulnerabilities.property IN (*) ) by Vulnerabilities.dest, Vulnerabilities.signature, Vulnerabilities.point_of_contact, Vulnerabilities.solution
| rename Vulnerabilities.* AS * 
| rename signature as sig
| lookup workday.csv shortid as point_of_contact output l1, l2,l3,l4
| search (l1="*" OR l2="*" OR l3="*" OR l4="*")
| fields - point_of_contact
| rex field=sig "^(?<Technology>[^\W]++)"
| stats sum(count) as count by Technology
| sort- count 
| head 10
| rename Red as "Red Hat"

This is the results:

Technology  count
 RHEL   6906424
Oracle  1507478
CentOS  402534
Network 186231
Ubuntu  129319
Red 109693
0 Karma
1 Solution

mayurr98
Super Champion

try this :

| tstats summariesonly=f dc(Vulnerabilities.signature) as count from datamodel="Vulnerabilitiesv3" where (nodename="Vulnerabilities" (Vulnerabilities.severity!=informational Vulnerabilities.severity!=unknown) Vulnerabilities.dest_bunit IN (*) Vulnerabilities.property IN (*) ) by Vulnerabilities.dest, Vulnerabilities.signature, Vulnerabilities.point_of_contact, Vulnerabilities.solution
 | rename Vulnerabilities.* AS * 
 | rename signature as sig
 | lookup workday.csv shortid as point_of_contact output l1, l2,l3,l4
 | search (l1="*" OR l2="*" OR l3="*" OR l4="*")
 | fields - point_of_contact
 | rex field=sig "^(?<Technology>[^\W]++)"
 | stats sum(count) as count by Technology
 | sort- count 
 | head 10
 | replace Red WITH "Red Hat" IN  Technology

let me know if this helps!

View solution in original post

woodcock
Esteemed Legend

You are using the wrong command. The rename command is for field names whereas the replace command is for field values. You need the latter.

mayurr98
Super Champion

try this :

| tstats summariesonly=f dc(Vulnerabilities.signature) as count from datamodel="Vulnerabilitiesv3" where (nodename="Vulnerabilities" (Vulnerabilities.severity!=informational Vulnerabilities.severity!=unknown) Vulnerabilities.dest_bunit IN (*) Vulnerabilities.property IN (*) ) by Vulnerabilities.dest, Vulnerabilities.signature, Vulnerabilities.point_of_contact, Vulnerabilities.solution
 | rename Vulnerabilities.* AS * 
 | rename signature as sig
 | lookup workday.csv shortid as point_of_contact output l1, l2,l3,l4
 | search (l1="*" OR l2="*" OR l3="*" OR l4="*")
 | fields - point_of_contact
 | rex field=sig "^(?<Technology>[^\W]++)"
 | stats sum(count) as count by Technology
 | sort- count 
 | head 10
 | replace Red WITH "Red Hat" IN  Technology

let me know if this helps!

Sukisen1981
Champion

you can rename technology as something else or count as say counts , to achieve this
try
|eval Technology=case(Technology="Red","Red Hat")

0 Karma

payton_tayvion
Path Finder

This only shows Red Hat results for some reason

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...