how i can rename the field output value in splunk.
below is the screen short
i want to RENAME
PPN | V0.2019 |2456 TO PPN | v0.1342 |2546
want to do changes in project update field and number of users side field for PPN client.
Hi,
You could use the eval command to achieve this.
I assume the values are hardcoded as in the question.
Please try and let us know.
|your_search
|eval "Project Update"=if(Clients="PPN","v0.1342",'Project Update')
|eval "Number of users"=if(Clients="PPN","2546",'Number of users')
|table Clients,"Project Update","Number of users"
Thanks @dindu no it is not hardcoded it is changing but i want to rename this time by manual.
what's v0.1342?
are you goiog to copy client PPN's values to CNB?
...
| eval "Project Update"=if(Client="CNB","v0.1342",'Project Update')
| eval "Number of users"=if(Client="CNB",2546,'Number of user')
If you want to change the field values, that's it.
sorry @to4kawa i have corrected the question it is PPN not CNB and v0.1342 is kind of version (updates)