rename command to rename fields. This command is useful for giving fields more meaningful names, such as "Product ID" instead of "pid". If you want to rename multiple fields, you can use wildcards.
Renames a specified field or multiple fields.
rename wc-field AS wc-field
- Syntax: <string>
- Description: The name of a field and the name to replace it. Can be wildcarded.
Use quotes to rename a field to a phrase:
... | rename SESSIONID AS sessionID
Use wildcards to rename multiple fields:
... | rename *ip AS IPaddress
If both the source and destination fields are wildcard expressions with the same number of wildcards, the renaming will carry over the wildcarded portions to the destination expression. See Example 2, below.
Note: You cannot rename one field with multiple names. For example if you had a field A, you can't do "A as B, A as C" in one string.
... | stats first(host) AS site, first(host) AS report
Note: You do not want to use this command to merge multiple fields into one field. For example, if you had events with either
... | rename pid AS product_id would not merge the
pid values into the
product_id field. It overwrites
product_id with Null values where
pid does not exist for the event. Instead, see the eval command and coalesce() function.
Example 1: Rename the "_ip" field as "IPAddress".
... | rename _ip as IPAddress
Example 2: Rename fields beginning with "foo" to begin with "bar".
... | rename foo* as bar*
Example 3: Rename the "count" field.
... | rename count as "CountofEvents"
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the rename command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 5.0 , 5.0.1 , 5.0.2