rename a field

[Pandey_21]

Hi All,

I am trying to rename a data but it is giving me error. I am doing in this way.

| rename "Data Time series* *errorcount=0" AS "Success" 

but error is : Error in 'rename' command: Wildcard mismatch: 'Data Time series* *errorcount=0' as 'Success'.

Log file:

Data Time series :: DataTimeSeries{requestId='482-fd1e-47-49-bf9b99f8', errorcount=0,

Can you please help me with correct rename command.

[gcusello]

Hi @Pandey_21,

rename is a command to rename field names not to replace a string, use replace (https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Replace) or rex to do this:

| replace "Data Time series* errorcount=0" AS "Success" 

Ciao.

Giuseppe