Splunk Search

rename a field

Pandey_21
New Member

Hi All,

 

I am trying to rename a data but it is giving me error. I am doing in this way.

| rename "Data Time series* *errorcount=0" AS "Success" 

but error is : Error in 'rename' command: Wildcard mismatch: 'Data Time series* *errorcount=0' as 'Success'.

 

Log file:

Data Time series :: DataTimeSeries{requestId='482-fd1e-47-49-bf9b99f8', errorcount=0,

 

Can you please help me with correct rename command.

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Pandey_21,

rename is a command to rename field names not to replace a string, use replace (https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Replace) or rex to do this:

| replace "Data Time series* errorcount=0" AS "Success" 

Ciao.

Giuseppe

 

 

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...