Splunk Search

renaming fields in search

asarolkar
Builder

I have a query like this

sourcetype="beta" index="alpha" | table fieldA, fieldB, fieldC

how do I rename fields fieldA to A, fieldB to B and fieldC to C

These fields are strings AND numbers (not sure how I would use stats or table)

1 Solution

sdaniels
Splunk Employee
Splunk Employee

you can use the rename command .... | rename fieldA AS newname, fieldB AS b | table newname, b

View solution in original post

landen99
Motivator

Perhaps more elegant (and practical for many fields) to do:

| rename field* AS *

jbuckner85
Path Finder

Thank you, this is very useful!

asarran
Path Finder

Hey, fellow Splunkers,

When I actually attempted to conduct multiple rename fields using that method, I receive the following error: rename [old_name AS/TO/-> new_name]+

0 Karma

cam343
Path Finder

Can you post the search it should be like:

| rename user_name AS user, src AS "IP Address", host AS "Server Name"

hope that helps...

0 Karma

sdaniels
Splunk Employee
Splunk Employee

you can use the rename command .... | rename fieldA AS newname, fieldB AS b | table newname, b

sdaniels
Splunk Employee
Splunk Employee

Agreed, I just changed it.

0 Karma

cam343
Path Finder

While the above works, you are probably better expanding rename command instead of piping to rename for every field you want renamed.

eg. | rename fieldA AS newnameA, fieldB AS newnameB, fieldC AS newnameC

instead of:
| rename fieldA AS newnameA |rename fieldB AS newnameB |rename fieldC AS newnameC

asarolkar
Builder

yup.. thanks a bunch

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...