Splunk Search

Dynamically change field name labels

cmak
Contributor

I have many fields that end with the regular expression _rate.
Ex:
Compile_rate
Typing_rate

I can get all my rates with this query
index="a" |stats dc() as * |transpose | regex column=^._rate.*$ |

However, I would like to rename these results in a new column, with the '_rate' removed.
So i would like to have Compile, Typing etc

How can I do this?

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You're looking for this:

... | rename *_rate as *

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You're looking for this:

... | rename *_rate as *

cmak
Contributor

Yup, that works. Sorry, I realized I was not changing my table fields. Quite silly 😞

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

This works for me:

... | rename *_rate as "* rate"

Here's a full example:

| gentimes start=-1 increment=5m | eval foo_rate = 1 | eval bar_rate = 2 | rename *_rate as "* rate"
0 Karma

cmak
Contributor

What if I wanted to do something like
rename Compile_rate as "Compile rate"

rename rate as " rate"
does not yield me any results

0 Karma

cmak
Contributor

Great, this worked 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...