Hi, I need to format a search very specifically so that the client's automation receives a report correctly. All I need is to rename a field name to a value with strftime(now(), "%Y%m%d")
in it, but the rename command doesn't seem to support that. Any way that I can make this value my header without altering the data?
@Uwbspeicher
please try this,
| eval today=strftime(now(),"%Y%m%d") | eval {today}=yourfieldheadername | fields - today yourfieldheadername
@Uwbspeicher
please try this,
| eval today=strftime(now(),"%Y%m%d") | eval {today}=yourfieldheadername | fields - today yourfieldheadername
That worked, thank you! Never seen the curly braces before; those are helpful.
@Uwbspeicher, can you share your existing query? The rename/re-format might be possible before the final transforming command.