Splunk Search

How to rename many fields one time?

NPR
Path Finder

For example, I have:
field_name0_NPR_pc field_name1_NPR_pc field_name2_NPR_pc ... field_namen_NPR_pc
I want change as this:
field_name0_NPR_pc as name0
field_name1_NPR_pc as name1
field_name2_NPR_pc as name2
...
field_namen_NPR_pc as namen
I've tried this:

...|rename field_name0_NPR_pc as name0|rename field_name1_NPR_pc as name1|...|field_namen_NPR_pc as namen|.. 

But it is very laborious.
How can I do it?

Thanks

Tags (3)
0 Karma
1 Solution

fdi01
Motivator

try like this:

...|rename field_*_NPR_pc as *|.. 

View solution in original post

fdi01
Motivator

try like this:

...|rename field_*_NPR_pc as *|.. 

NPR
Path Finder

very thank.

0 Karma

ngatchasandra
Builder

Hi,

Try with this

  ...|rename field_name*_NPR_pc as name*| table name*

NPR
Path Finder

thank for your approach
but name is no the same.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...