Because there is a spelling mistake in fieldname JSESSIONID
which is misspelled as JESESSIONID
inside the rename command. Please try the following:
index=main sourcetype=access_combined_wcookie action=purchase status=200 file="success.do" JSESSIONID="*"
| rename JSESSIONID as UserSessions
PS: Your base search has correct fieldname.
Because there is a spelling mistake in fieldname JSESSIONID
which is misspelled as JESESSIONID
inside the rename command. Please try the following:
index=main sourcetype=access_combined_wcookie action=purchase status=200 file="success.do" JSESSIONID="*"
| rename JSESSIONID as UserSessions
PS: Your base search has correct fieldname.
Thank you very much. That worked