Splunk Search

How to rename many fields one time?

NPR
Path Finder

For example, I have:
field_name0_NPR_pc field_name1_NPR_pc field_name2_NPR_pc ... field_namen_NPR_pc
I want change as this:
field_name0_NPR_pc as name0
field_name1_NPR_pc as name1
field_name2_NPR_pc as name2
...
field_namen_NPR_pc as namen
I've tried this:

...|rename field_name0_NPR_pc as name0|rename field_name1_NPR_pc as name1|...|field_namen_NPR_pc as namen|.. 

But it is very laborious.
How can I do it?

Thanks

Tags (3)
0 Karma
1 Solution

fdi01
Motivator

try like this:

...|rename field_*_NPR_pc as *|.. 

View solution in original post

fdi01
Motivator

try like this:

...|rename field_*_NPR_pc as *|.. 

NPR
Path Finder

very thank.

0 Karma

ngatchasandra
Builder

Hi,

Try with this

  ...|rename field_name*_NPR_pc as name*| table name*

NPR
Path Finder

thank for your approach
but name is no the same.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...