Splunk Search

Why isn't the rename command not renaming fields?

Explorer

I'm currently creating a list that lists top 10 technologies and I'm trying to rename "Red" as "Red Hat" using the rename command.
Here's the query:

| tstats summariesonly=f dc(Vulnerabilities.signature) as count from datamodel="Vulnerabilitiesv3" where (nodename="Vulnerabilities" (Vulnerabilities.severity!=informational Vulnerabilities.severity!=unknown) Vulnerabilities.dest_bunit IN (*) Vulnerabilities.property IN (*) ) by Vulnerabilities.dest, Vulnerabilities.signature, Vulnerabilities.point_of_contact, Vulnerabilities.solution
| rename Vulnerabilities.* AS * 
| rename signature as sig
| lookup workday.csv shortid as point_of_contact output l1, l2,l3,l4
| search (l1="*" OR l2="*" OR l3="*" OR l4="*")
| fields - point_of_contact
| rex field=sig "^(?<Technology>[^\W]++)"
| stats sum(count) as count by Technology
| sort- count 
| head 10
| rename Red as "Red Hat"

This is the results:

Technology  count
 RHEL   6906424
Oracle  1507478
CentOS  402534
Network 186231
Ubuntu  129319
Red 109693
0 Karma
1 Solution

SplunkTrust
SplunkTrust

try this :

| tstats summariesonly=f dc(Vulnerabilities.signature) as count from datamodel="Vulnerabilitiesv3" where (nodename="Vulnerabilities" (Vulnerabilities.severity!=informational Vulnerabilities.severity!=unknown) Vulnerabilities.dest_bunit IN (*) Vulnerabilities.property IN (*) ) by Vulnerabilities.dest, Vulnerabilities.signature, Vulnerabilities.point_of_contact, Vulnerabilities.solution
 | rename Vulnerabilities.* AS * 
 | rename signature as sig
 | lookup workday.csv shortid as point_of_contact output l1, l2,l3,l4
 | search (l1="*" OR l2="*" OR l3="*" OR l4="*")
 | fields - point_of_contact
 | rex field=sig "^(?<Technology>[^\W]++)"
 | stats sum(count) as count by Technology
 | sort- count 
 | head 10
 | replace Red WITH "Red Hat" IN  Technology

let me know if this helps!

View solution in original post

Esteemed Legend

You are using the wrong command. The rename command is for field names whereas the replace command is for field values. You need the latter.

SplunkTrust
SplunkTrust

try this :

| tstats summariesonly=f dc(Vulnerabilities.signature) as count from datamodel="Vulnerabilitiesv3" where (nodename="Vulnerabilities" (Vulnerabilities.severity!=informational Vulnerabilities.severity!=unknown) Vulnerabilities.dest_bunit IN (*) Vulnerabilities.property IN (*) ) by Vulnerabilities.dest, Vulnerabilities.signature, Vulnerabilities.point_of_contact, Vulnerabilities.solution
 | rename Vulnerabilities.* AS * 
 | rename signature as sig
 | lookup workday.csv shortid as point_of_contact output l1, l2,l3,l4
 | search (l1="*" OR l2="*" OR l3="*" OR l4="*")
 | fields - point_of_contact
 | rex field=sig "^(?<Technology>[^\W]++)"
 | stats sum(count) as count by Technology
 | sort- count 
 | head 10
 | replace Red WITH "Red Hat" IN  Technology

let me know if this helps!

View solution in original post

Champion

you can rename technology as something else or count as say counts , to achieve this
try
|eval Technology=case(Technology="Red","Red Hat")

0 Karma

Explorer

This only shows Red Hat results for some reason

0 Karma