Splunk Search

"As" command modifier not working

grook
New Member

New to Splunk. Trying to use the "as" command modifier to change the name of a column. However, the modifier is not being highlighted or changing the column name.

Here is my SPL string:
sourcetype="access_combined_wcookie" status=200 file="success.do"
| table JSESSIONID as UserSession

Tags (1)
0 Karma

pruthvikrishnap
Contributor

Hi Grook,
U will have to rename the command prior to |table, such as
| rename JSESSIONID as usersession
and then call it to table

0 Karma

grook
New Member

Like this?

sourcetype="access_combined_wcookie" status=200 file="success.do"
| rename JSESSIONID as UserSessions
| table UserSession

0 Karma

niketn
Legend

Seems typo, field name should match, so if you rename you should use exact field name afterwards.

  | rename JSESSIONID as UserSessions
  | table UserSessions

If you have space or special characters in the field name you should use double quotes. For example

  | rename JSESSIONID as "User Session IDs"
  | table "User Session IDs"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

pruthvikrishnap
Contributor

yeah did it work?

0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...