Splunk Search

rename field with *

secure
Path Finder

Hi 

i have a field with name 

server_*_count. the * is coming from an input dropdown ALL where value is * 

how can i rename it to server_ALL_count

|rename server_*_count as server_ALL_count

its giving me an error cannot be renamed because of asterix (wildcard)

Labels (1)
Tags (1)
0 Karma

secure
Path Finder

@bowesmana 

here is the dropdown ALL value = * 

secure_0-1738186419172.png

in the query 

secure_2-1738186509556.png

so when selected all it comes as server_*_count

 

 

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Like @bowesmana says


but do you really need the $env$ in the field name?

Wouldn't 

| stats dc(hostname) by host_environment

make more sense in a dashboard? 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

OK, so it's getting created in the stats command. So don't use that technique. Do something like

| stats dc(hostname) as server_count
| eval n=if($env|s$="*", "ALL", $env|s$)
| eval server_{n}_count=server_count
| fields - server_count

but do you really need the $env$ in the field name? Is this dashboard studio - you can probably assign an additional token $env_name$ based on the selected NAME of the environment rather than the token value. I'm not familiar enough with DS to say how to do this, but you can then use $env$ as the search constraint and $env_name$ as the server name.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can't rename it like that - how does that field exist? Is it actually in the data or is it created somehow.

Can you post the dropdown where that field is created?

 

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...