Rename
Use the rename function to rename one or more fields. If you want to rename fields with similar names, you can use a wildcard character.
- Function Input
- collection<record<R>>
- This function takes in collections of records with schema R.
- Function Output
- collection<record<S>>
- This function outputs the same collection of records but with a different schema S.
Arguments
Argument | Input | Description | UI example |
---|---|---|---|
fields | collection<string> | A list of fields to rename and their new names | type body , click +, type _raw , click +, type timestamp , click +, type time .
|
DSL example
This example renames body
, which is cast as a string, to _raw
:
rename(inputs, "body", "_raw");
Parse regex (rex) | Union |
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.0.0
Feedback submitted, thanks!