I have some ticketing data being imported into Splunk for analysis. There are a couple of field names with an asterix (*) in them.
Example - Priority*
How do I rename such a field to just "Priority", or a non-wildcard string? Thanks !!
| transpose
| replace "Priority*" with Priority
| transpose header_field=column
To build on this and make it rename all field names containing wildcards at once:
| transpose
| rex field=column mode=sed "s/\*//g"
| transpose header_field=column
| fields - column
@makarand13 can you post raw events where such wildcard based fields exist?
The following could be a fix during search time however, you should rather fix it while indexing using SEDCMD
<yourBaseSearch>
| eval priority='Priority*'
| fields - Priority*
Upvoting this especially to reinforce that the best solution is to fix while indexing!