Splunk Search

How to set all column names to capital letters

DavidHourani
Super Champion

Hello dear Splunkers,

Any idea how to set column names to uppercase/capital letters?
I'm not talking about all the data in the data set, just the column names. I have a table with 10 column and 10000 events and would like to have the column names in capital letters.
Also I don't want to have to go through 10 renames, I'm looking for an automatic way to set them all to capital letters in case i add extra columns.

Regards,
David

0 Karma
1 Solution

acharlieh
Influencer

I think having a command with explicit renames is honestly your best bet performance wise... Using an eval trick I learned from @alacercogitatus I came up with:

... |  foreach * [eval temp=upper("<<FIELD>>"), {temp}='<<FIELD>>'| fields - "<<FIELD>>" temp ] 

However it too seems to scale terribly with lots of results, taking longer than the base search for merely a few thousand results due to the number of executions it has to make versus a single explicit rename command listing all fields

View solution in original post

acharlieh
Influencer

I think having a command with explicit renames is honestly your best bet performance wise... Using an eval trick I learned from @alacercogitatus I came up with:

... |  foreach * [eval temp=upper("<<FIELD>>"), {temp}='<<FIELD>>'| fields - "<<FIELD>>" temp ] 

However it too seems to scale terribly with lots of results, taking longer than the base search for merely a few thousand results due to the number of executions it has to make versus a single explicit rename command listing all fields

rjthibod
Champion

I don't think there is a shortcut to doing this without using rename many times. I do not think you can use fieldformat and foreach directly. There may be some roundabout way using appendpipe to generate a list of new field names and then renaming the old names, but that seems a bit much.

0 Karma

DavidHourani
Super Champion

I was thinking about something with a transpose -> eval upper -> transpose... But it doesnt seem to work with a lot of rows..

0 Karma

rjthibod
Champion

Correct, there is a limit on transpose.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...