Splunk Search

renaming fields in search

asarolkar
Builder

I have a query like this

sourcetype="beta" index="alpha" | table fieldA, fieldB, fieldC

how do I rename fields fieldA to A, fieldB to B and fieldC to C

These fields are strings AND numbers (not sure how I would use stats or table)

1 Solution

sdaniels
Splunk Employee
Splunk Employee

you can use the rename command .... | rename fieldA AS newname, fieldB AS b | table newname, b

View solution in original post

landen99
Motivator

Perhaps more elegant (and practical for many fields) to do:

| rename field* AS *

jbuckner85
Path Finder

Thank you, this is very useful!

asarran
Path Finder

Hey, fellow Splunkers,

When I actually attempted to conduct multiple rename fields using that method, I receive the following error: rename [old_name AS/TO/-> new_name]+

0 Karma

cam343
Path Finder

Can you post the search it should be like:

| rename user_name AS user, src AS "IP Address", host AS "Server Name"

hope that helps...

0 Karma

sdaniels
Splunk Employee
Splunk Employee

you can use the rename command .... | rename fieldA AS newname, fieldB AS b | table newname, b

sdaniels
Splunk Employee
Splunk Employee

Agreed, I just changed it.

0 Karma

cam343
Path Finder

While the above works, you are probably better expanding rename command instead of piping to rename for every field you want renamed.

eg. | rename fieldA AS newnameA, fieldB AS newnameB, fieldC AS newnameC

instead of:
| rename fieldA AS newnameA |rename fieldB AS newnameB |rename fieldC AS newnameC

asarolkar
Builder

yup.. thanks a bunch

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...