Splunk Search

How to rename a field name with curly braces to compare it to a field in a lookup?

ashishlal82
Explorer

How can I rename a field name with curly braces attached to it e.g. cxy{} and then compare to a field within a lookup?

Tags (3)
0 Karma

somesoni2
Revered Legend

You can rename a field using the rename command like this

your base search  | rename abc{} as abc 

or

your base search  | rename  abc{}.* as *

However, you can do a lookup without renaming the field like this

your base search | lookup lookupname lookukpfield as abc{} OUTPUT lookupfield
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...