Splunk® Cloud Services

SPL2 Search Reference

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

rename command examples

The following are examples for using the SPL2 rename command. To learn more about the rename command, see How the rename command works.

The AS keyword is displayed in uppercase in the syntax and examples to make the syntax easier to read. You can specify the AS keyword in uppercase or lowercase in your searches.

1. Rename one field

Rename the usr field to username.

...| rename usr AS username

2. Rename a field with special characters

Rename the ip-add field to IPAddress. Field names that contain anything other than a-z, A-Z, 0-9, or "_", need single-quotation marks.

... | rename 'ip-add' AS IPAddress

3. Specify multiple fields to rename

Use a comma-separated list of renames that you want to perform. This example renames usr to username and dpt to department. Renames are processed in the order that you specify, left to right.

...| rename usr AS username, dpt AS department

4. Rename multiple similarly named fields using wildcards

This example renames any field that starts with u to start with user. Because wildcard characters are used, the field names must be enclosed in single quotation marks.

...| rename 'u*' AS 'user*'

5. Rename a field with a phrase

This example renames a field with a string phrase. Because the phrase includes spaces, the field name must be enclosed in single quotation marks.

... | rename count AS 'Count of Events'

See also

rename command
rename command overview
rename command syntax details
rename command usage
Last modified on 29 April, 2020
PREVIOUS
rename command usage
  NEXT
reverse command overview

This documentation applies to the following versions of Splunk® Cloud Services: current


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters