Splunk Search

help on rename which doesnt works

Contributor

Hello

I use the search below but I don't know why the rename command doesn't works

Thanks for your help

 

| inputlookup fo_all 
| fields SITE 
| dedup SITE 
| rename "ABCD" as "AB"
| table SITE

 

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

Super Champion

okay. I believe there is an Item ABCD in your SITE field and you would want to rename it to AB. if is that what you are looking for then use below:

| inputlookup fo_all 
| stats count by SITE
| fields SITE 
| eval SITE=if(SITE=="ABCD","AB",SITE)
————————————
If this helps, give a like below.

View solution in original post

0 Karma

Super Champion
| inputlookup fo_all  
| fields SITE # you are limiting fields to one field SITE, from here on you will have only one field.
| dedup SITE 
| rename "ABCD" as "AB" # you are trying to rename field ABCD to AB which you don't have at this moment. 
| table SITE
————————————
If this helps, give a like below.
Tags (1)
0 Karma

Builder

Rename is for field names. You have reduced your fields to just SITE. There is no field ABCD for you to rename as AB. What is it you are trying to do?

0 Karma

Contributor

Hi I need to rename the items of the field SITE

Tags (1)
0 Karma

Super Champion

okay. I believe there is an Item ABCD in your SITE field and you would want to rename it to AB. if is that what you are looking for then use below:

| inputlookup fo_all 
| stats count by SITE
| fields SITE 
| eval SITE=if(SITE=="ABCD","AB",SITE)
————————————
If this helps, give a like below.

View solution in original post

0 Karma

Contributor

thanks it works

0 Karma

Builder

Hi @jip31 

What @thambisetty  has suggested works fine for ABCD "renamed" to AB but I suspect this is just example data and what you want is something more generic, perhaps substr() or replace() might be more useful, you may want to consider using case() and match() to do different "renames"

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!