Splunk Search

Is it possible to change case of a column name?

ma_anand1984
Contributor

I would like to change case of column name. Is it possible. My column name changes at run time and is not known at the time of writing the query

Tags (4)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

If you want ALL fieldnames to be upper case, then do this at the end...

| streamstats count as recno
| untable recno fieldname fieldvalue
| eval fieldname = upper(fieldname)
| xyseries recno fieldname fieldvalue
| fields - recno

Be aware that the above code will turn multivalue fields to single value fields as if they had been nomved. The following code will protect an mv field called "foo".

| streamstats count as recno
| eval foo = mvjoin(foo,"!!!!")
| untable recno fieldname fieldvalue
| eval fieldname = upper(fieldname)
| xyseries recno fieldname fieldvalue
| eval FOO = split(FOO,"!!!!")
| fields - recno
0 Karma

grantsmiley
Path Finder

see if this helps you
| foreach * [| eval "uppered<<MATCHSTR>>"='<<MATCHSTR>>' ]

0 Karma

grantsmiley
Path Finder

That's a way to get the dynamic column name thing solved.

0 Karma

asimagu
Builder

I am guessing you want the column name to be renamed for the result of the search?

If that is the case you can pipe your search to

| rename column_name AS "your_new_name"

if you want to change the name of the field before doing calculations with the new name, you should use the eval command

| eval new_name=old_name

0 Karma

ma_anand1984
Contributor

@asimagu Thanks for your reply but it didnt answer my query. I dont know the column name. it is created at run time.
| rename column_name AS "your_new_name". i want "your_new_name" to be like "COLUMN_NAME" - upper case of whatever is present in the column

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...